154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21

Analysis

max time kernel
95s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe
Size

771KB
MD5

7367c44d45be78c51eef7aefaa660f0e
SHA1

65237acbda6407660a29f736f3c3e885af0eb1d5
SHA256

154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21
SHA512

70ecaf22e8c643be9ad5fe2cc801b36e6dcf249e4e3fdad12ca6f0981f5bf7429d20848df75b94878ba6adeaeb49bb8c4ce574067747ef298098eb84e92a8d38
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 9 IoCs

Processes:

Dropbox.exe

description	ioc	process
File created	C:\Windows\system32\DRIVERS\SET36CA.tmp	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\dbx-stable.sys	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET36CB.tmp	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\dbx-canary.sys	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET36CA.tmp	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\dbx-dev.sys	Dropbox.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET36DC.tmp	Dropbox.exe
File created	C:\Windows\system32\DRIVERS\SET36DC.tmp	Dropbox.exe
File created	C:\Windows\system32\DRIVERS\SET36CB.tmp	Dropbox.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies Windows Firewall 2 TTPs 3 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exe

pid process

2928 netsh.exe
3220 netsh.exe
3928 netsh.exe

pid	process
2928	netsh.exe
3220	netsh.exe
3928	netsh.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DropboxUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Dropbox.exeDropbox.exeDropbox.exeDropboxUpdate.exeDropbox.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Dropbox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Dropbox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Dropbox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	Dropbox.exe

Executes dropped EXE 25 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxClient_192.4.4605.x64.exeDropbox.exeDbxSvc.exedismhost.exeDropboxCrashHandler.exeDropboxUpdateOnDemand.exeDropboxUpdate.exeDropbox.exeDropbox.exeDropbox.exeDropboxUpdate.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exe

pid	process
2468	DropboxUpdate.exe
3640	DropboxUpdate.exe
644	DropboxUpdate.exe
2404	DropboxUpdate.exe
4712	DropboxUpdate.exe
2808	DropboxUpdate.exe
2256	DropboxClient_192.4.4605.x64.exe
3356	Dropbox.exe
2100	DbxSvc.exe
3640	dismhost.exe
2836	DropboxCrashHandler.exe
2480	DropboxUpdateOnDemand.exe
2992	DropboxUpdate.exe
744	Dropbox.exe
1524	Dropbox.exe
3256	Dropbox.exe
1228	DropboxUpdate.exe
2052	Dropbox.exe
2248	Dropbox.exe
884	Dropbox.exe
2716	Dropbox.exe
4300	Dropbox.exe
4216	Dropbox.exe
2664	Dropbox.exe
4128	Dropbox.exe

Loads dropped DLL 64 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxClient_192.4.4605.x64.exeDropbox.exe

pid	process
2468	DropboxUpdate.exe
3640	DropboxUpdate.exe
644	DropboxUpdate.exe
644	DropboxUpdate.exe
644	DropboxUpdate.exe
644	DropboxUpdate.exe
2468	DropboxUpdate.exe
2404	DropboxUpdate.exe
4712	DropboxUpdate.exe
2808	DropboxUpdate.exe
2808	DropboxUpdate.exe
4712	DropboxUpdate.exe
2256	DropboxClient_192.4.4605.x64.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe
3356	Dropbox.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\DropboxExt\ = "{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\DropboxExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\DropboxExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\DropboxExt\ = "{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\DropboxExt	regsvr32.exe

Registers COM server for autorun 1 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

Dropbox.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1B}\InProcServer32\ = "%SYSTEMROOT%\\system32\\shell32.dll"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF142CA5-83C5-4E06-8FEA-310AA519A945}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\192.4.4605\\DropboxOfficeAddin64.14.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\LocalServer32	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\InProcServer32	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1B}\InProcServer32	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF142CA5-83C5-4E06-8FEA-310AA519A945}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\InProcServer32\ = "%SYSTEMROOT%\\system32\\shell32.dll"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" /autoplay"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF142CA5-83C5-4E06-8FEA-310AA519A945}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt64.69.0.dll"	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Dropbox.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Dropbox = "\"C:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" /systemstartup"	Dropbox.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

13 2532 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Dropbox.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Dropbox.exe

flow	pid	process
13	2532	msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Dropbox.exe

Enumerates connected drives 3 TTPs 35 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Drops file in System32 directory 11 IoCs

Processes:

DropboxUpdate.exeDropbox.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\system32\SET36DD.tmp	Dropbox.exe
File created	C:\Windows\system32\SET36DD.tmp	Dropbox.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\system32\DbxSvc.exe	Dropbox.exe

Drops file in Program Files directory 64 IoCs

Processes:

Dropbox.exeDropboxClient_192.4.4605.x64.exeDropboxUpdate.exe154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe

description	ioc	process
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtQuick\Controls\Styles\Desktop\RadioButtonStyle.qml	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\api-ms-win-crt-multibyte-l1-1-0.dll	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\backup.targetsize-48.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\papert.targetsize-512.png	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\locales\fr.pak	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\light\[email protected]	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\light\[email protected]	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-72_altform-unplated_contrast-white.png	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\vcruntime140.dll	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\logo.targetsize-20_altform-unplated_contrast-white.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\libffi-7.dll	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\_cffi_backend.cp38-win_amd64.pyd	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\logo.targetsize-16_altform-unplated_contrast-black.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\plugins\imageformats\qgif.dll	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\python38.dll	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\PackageAssets\Assets\logo.contrast-white_scale-100.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\legacy\dropboxstatus-snooze.png	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\PackageAssets\Assets\logo.targetsize-36_altform-unplated_contrast-white.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\dropboxstatus-notification.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\Styles\Desktop\ApplicationWindowStyle.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\Dropbox.exe	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\resources.pak	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\StatusBar.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\DropboxExt64.69.0.dll	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\api-ms-win-crt-runtime-l1-1-0.dll	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\binder.targetsize-16.png	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\logo.targetsize-96_contrast-white.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\vccorlib140.dll	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\external_drive.targetsize-64.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\logo.targetsize-30_altform-unplated.png	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\backup.targetsize-16.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtQuick\Controls\Private\FocusFrame.qml	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtQuick\Controls\Styles\Base\images\leftanglearrow.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\DropboxExt.69.0.dll	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\CheckBox.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\PackageAssets\Assets\logo.contrast-black_scale-125.png	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\PackageAssets\Assets\logo.targetsize-48_altform-unplated_contrast-black.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\light\[email protected]	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\external_drive.targetsize-48.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\Private\SystemPaletteSingleton.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Strings\language-de\Resources.resw	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtGraphicalEffects\ZoomBlur.qml	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtQuick\Controls\Styles\Base\StatusBarStyle.qml	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_sv.dll	154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Assets\logo.targetsize-30.png	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtQuick\Controls\qmldir	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\QtQuick\Controls\Private\MenuItemSubControls.qml	Dropbox.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdate.dll	154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\QtGraphicalEffects\ConicalGradient.qml	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-72.png	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]	Dropbox.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\dark\dropboxstatus-idle.png	DropboxClient_192.4.4605.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\locales\nb.pak	DropboxClient_192.4.4605.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_192.4.4605\PackageAssets\Assets\logo.targetsize-16_altform-unplated_contrast-white.png	DropboxClient_192.4.4605.x64.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeDropboxUpdate.exepowershell.exedismhost.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File created	C:\Windows\Installer\e575a3a.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C39.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Installer\e575a36.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e575a36.msi	msiexec.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4212 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4212	sc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

DropboxUpdate.exeSearchApp.exeSearchApp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

msiexec.exeDropboxUpdate.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E	DropboxUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DropboxUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DropboxUpdate.exe

Modifies registry class 64 IoCs

Processes:

DropboxUpdate.exeregsvr32.exeregsvr32.exeDropbox.exeexplorer.exeDropboxUpdate.exemsiexec.exeregsvr32.exeexplorer.exeregsvr32.exeexplorer.exeStartMenuExperienceHost.exeSearchApp.exeSearchApp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DD80E78-80D7-4E12-90CA-CBF68A68B1B3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Dropbox.PaperT\shell\Open\Command	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.PaperT\shell\Open\Command	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.web\OpenWithProgids	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\ = "DropboxExt10 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer\ = "DropboxUpdate.Update3COMClassService.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CurVer\ = "DropboxUpdate.OnDemandCOMClassSvc.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.Passwords\shell	Dropbox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF142CA5-83C5-4E06-8FEA-310AA519A945}\VersionIndependentProgID\ = "Dropbox.OfficeAddIn"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID\ = "DropboxUpdate.Update3WebMachineFallback.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt.69.0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Dropbox.AutoplayEventHandler\CurVer	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF142CA5-83C5-4E06-8FEA-310AA519A945}\VersionIndependentProgID\ = "Dropbox.OfficeAddIn"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.Paper	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.Backup\shell\Open\Command	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\DropboxUpdateOnDemand.exe\""	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Client\\DropboxExt.69.0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "ServiceModule"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer\ = "DropboxUpdate.CoreMachineClass.1"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "Dropbox Update Legacy On Demand"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\CLSID\ = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DD80E78-80D7-4E12-90CA-CBF68A68B1B3}\ = "IRibbonCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\ShellFolder\FolderValueFlags = "40"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.Shortcut\ = "Shortcut"	Dropbox.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\ = "CoCreateAsync"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ = "IApp"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Dropbox.AutoplayEventHandler.4\CLSID	Dropbox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dropbox-install\shell\	Dropbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\DropboxExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.Gdoc\ = "Google Docs File"	Dropbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\ProgID	DropboxUpdate.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Dropbox.exe

pid process

744 Dropbox.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

DropboxUpdate.exemsiexec.exeDropbox.exepowershell.exepowershell.exeDropboxUpdate.exeDropboxUpdate.exeDropbox.exeDropbox.exeDropbox.exeDropbox.exe

pid	process
2468	DropboxUpdate.exe
2468	DropboxUpdate.exe
2532	msiexec.exe
2532	msiexec.exe
3356	Dropbox.exe
3356	Dropbox.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
4712	DropboxUpdate.exe
4712	DropboxUpdate.exe
1228	DropboxUpdate.exe
1228	DropboxUpdate.exe
2468	DropboxUpdate.exe
2468	DropboxUpdate.exe
2468	DropboxUpdate.exe
2468	DropboxUpdate.exe
2052	Dropbox.exe
2052	Dropbox.exe
884	Dropbox.exe
884	Dropbox.exe
4300	Dropbox.exe
4300	Dropbox.exe
4300	Dropbox.exe
4300	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DropboxUpdate.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2468	DropboxUpdate.exe
Token: SeShutdownPrivilege	2468	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	2468	DropboxUpdate.exe
Token: SeSecurityPrivilege	2532	msiexec.exe
Token: SeCreateTokenPrivilege	2468	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	2468	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	2468	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	2468	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	2468	DropboxUpdate.exe
Token: SeTcbPrivilege	2468	DropboxUpdate.exe
Token: SeSecurityPrivilege	2468	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	2468	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	2468	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	2468	DropboxUpdate.exe
Token: SeSystemtimePrivilege	2468	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	2468	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	2468	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	2468	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	2468	DropboxUpdate.exe
Token: SeBackupPrivilege	2468	DropboxUpdate.exe
Token: SeRestorePrivilege	2468	DropboxUpdate.exe
Token: SeShutdownPrivilege	2468	DropboxUpdate.exe
Token: SeDebugPrivilege	2468	DropboxUpdate.exe
Token: SeAuditPrivilege	2468	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	2468	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	2468	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	2468	DropboxUpdate.exe
Token: SeUndockPrivilege	2468	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	2468	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	2468	DropboxUpdate.exe
Token: SeManageVolumePrivilege	2468	DropboxUpdate.exe
Token: SeImpersonatePrivilege	2468	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	2468	DropboxUpdate.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe
Token: SeTakeOwnershipPrivilege	2532	msiexec.exe
Token: SeRestorePrivilege	2532	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

explorer.exeDropbox.exeexplorer.exe

pid	process
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
744	Dropbox.exe
744	Dropbox.exe
4572	explorer.exe
4572	explorer.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
744	Dropbox.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exeDropbox.exeexplorer.exeexplorer.exe

pid	process
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
4572	explorer.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
4572	explorer.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
744	Dropbox.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
1584	explorer.exe
744	Dropbox.exe
1584	explorer.exe
1584	explorer.exe
744	Dropbox.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe
3696	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

Dropbox.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exe

pid	process
744	Dropbox.exe
4376	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2424	StartMenuExperienceHost.exe
2156	SearchApp.exe
6136
2460	StartMenuExperienceHost.exe
4488	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exeDropboxUpdate.exeDropboxUpdate.exeDropboxClient_192.4.4605.x64.exeDropbox.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exerunonce.exepowershell.exeDropboxUpdateOnDemand.exe

description	pid	process	target process
PID 1528 wrote to memory of 2468	1528	154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe	DropboxUpdate.exe
PID 1528 wrote to memory of 2468	1528	154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe	DropboxUpdate.exe
PID 1528 wrote to memory of 2468	1528	154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 3640	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 3640	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 3640	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 644	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 644	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 644	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 2404	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 2404	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 2404	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 4712	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 4712	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2468 wrote to memory of 4712	2468	DropboxUpdate.exe	DropboxUpdate.exe
PID 2808 wrote to memory of 2256	2808	DropboxUpdate.exe	DropboxClient_192.4.4605.x64.exe
PID 2808 wrote to memory of 2256	2808	DropboxUpdate.exe	DropboxClient_192.4.4605.x64.exe
PID 2808 wrote to memory of 2256	2808	DropboxUpdate.exe	DropboxClient_192.4.4605.x64.exe
PID 2256 wrote to memory of 3356	2256	DropboxClient_192.4.4605.x64.exe	Dropbox.exe
PID 2256 wrote to memory of 3356	2256	DropboxClient_192.4.4605.x64.exe	Dropbox.exe
PID 3356 wrote to memory of 2928	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 2928	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 3220	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 3220	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 3928	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 3928	3356	Dropbox.exe	netsh.exe
PID 3356 wrote to memory of 2072	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 2072	3356	Dropbox.exe	regsvr32.exe
PID 2072 wrote to memory of 2976	2072	regsvr32.exe	regsvr32.exe
PID 2072 wrote to memory of 2976	2072	regsvr32.exe	regsvr32.exe
PID 2072 wrote to memory of 2976	2072	regsvr32.exe	regsvr32.exe
PID 3356 wrote to memory of 628	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 628	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 628	3356	Dropbox.exe	regsvr32.exe
PID 628 wrote to memory of 2440	628	regsvr32.exe	regsvr32.exe
PID 628 wrote to memory of 2440	628	regsvr32.exe	regsvr32.exe
PID 3356 wrote to memory of 968	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 968	3356	Dropbox.exe	regsvr32.exe
PID 968 wrote to memory of 4968	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 4968	968	regsvr32.exe	regsvr32.exe
PID 968 wrote to memory of 4968	968	regsvr32.exe	regsvr32.exe
PID 3356 wrote to memory of 456	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 456	3356	Dropbox.exe	regsvr32.exe
PID 3356 wrote to memory of 456	3356	Dropbox.exe	regsvr32.exe
PID 456 wrote to memory of 3172	456	regsvr32.exe	regsvr32.exe
PID 456 wrote to memory of 3172	456	regsvr32.exe	regsvr32.exe
PID 3356 wrote to memory of 3096	3356	Dropbox.exe	runonce.exe
PID 3356 wrote to memory of 3096	3356	Dropbox.exe	runonce.exe
PID 3096 wrote to memory of 1352	3096	runonce.exe	grpconv.exe
PID 3096 wrote to memory of 1352	3096	runonce.exe	grpconv.exe
PID 3356 wrote to memory of 4212	3356	Dropbox.exe	sc.exe
PID 3356 wrote to memory of 4212	3356	Dropbox.exe	sc.exe
PID 3356 wrote to memory of 1840	3356	Dropbox.exe	powershell.exe
PID 3356 wrote to memory of 1840	3356	Dropbox.exe	powershell.exe
PID 3356 wrote to memory of 4600	3356	Dropbox.exe	powershell.exe
PID 3356 wrote to memory of 4600	3356	Dropbox.exe	powershell.exe
PID 4600 wrote to memory of 3640	4600	powershell.exe	dismhost.exe
PID 4600 wrote to memory of 3640	4600	powershell.exe	dismhost.exe
PID 2808 wrote to memory of 2836	2808	DropboxUpdate.exe	DropboxCrashHandler.exe
PID 2808 wrote to memory of 2836	2808	DropboxUpdate.exe	DropboxCrashHandler.exe
PID 2808 wrote to memory of 2836	2808	DropboxUpdate.exe	DropboxCrashHandler.exe
PID 2480 wrote to memory of 2992	2480	DropboxUpdateOnDemand.exe	DropboxUpdate.exe
PID 2480 wrote to memory of 2992	2480	DropboxUpdateOnDemand.exe	DropboxUpdate.exe
PID 2480 wrote to memory of 2992	2480	DropboxUpdateOnDemand.exe	DropboxUpdate.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe
"C:\Users\Admin\AppData\Local\Temp\154e05bf70bd19e6f14a705e13bdccaf797c7fe41c22e3aff9cfe6b741056a21.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1528

C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS2drQVVCdEJYa2J1T21KOXY1dDVwYS1CQ2lvajJVaWFrcVNPTkNSSzllNTM5LWREMVBULXFPVDZia1hZWkhWXzEwTjE0NVpTS1M1OGZZajJVLTlONTdaYkpGN0wwVzgySzJjSEMwaWFqMUtUVXhyRnE3XzlzalRVUXdEdldBUzRvUVlCUjFrTTB4QnN0OFBqLUFCY0JJSVl-QE1FVEEifQ"
2⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3640

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:644

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNuZE9lVGd3UzJkclFWVkNkRUpZYTJKMVQyMUtPWFkxZERWd1lTMUNRMmx2YWpKVmFXRnJjVk5QVGtOU1N6bGxOVE01TFdSRU1WQlVMWEZQVkRaaWExaFpXa2hXWHpFd1RqRTBOVnBUUzFNMU9HWlphakpWTFRsT05UZGFZa3BHTjB3d1Z6Z3lTekpqU0VNd2FXRnFNVXRVVlhoeVJuRTNYemx6YWxSVlVYZEVkbGRCVXpSdlVWbENVakZyVFRCNFFuTjBPRkJxTFVGQ1kwSkpTVmwtUUUxRlZFRWlmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjgxNy4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezc4QjYxOUNFLTVGODEtNDc3Ri04N0JELTZCQTNEQ0Y3Rjc0OX0iIHVzZXJpZD0ie0Q4QTY2MjVCLTQzREUtNDg4OS1CODNGLTBDMkJENEU0OTY2MX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBMEMyNTU1QS0wRjZGLTQ0OEItQkQxRC0xNjA5NTVGRUU4NDN9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjgxNy4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS2drQVVCdEJYa2J1T21KOXY1dDVwYS1CQ2lvajJVaWFrcVNPTkNSSzllNTM5LWREMVBULXFPVDZia1hZWkhWXzEwTjE0NVpTS1M1OGZZajJVLTlONTdaYkpGN0wwVzgySzJjSEMwaWFqMUtUVXhyRnE3XzlzalRVUXdEdldBUzRvUVlCUjFrTTB4QnN0OFBqLUFCY0JJSVl-QE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{78B619CE-5F81-477F-87BD-6BA3DCF7F749}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2808

C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe
"C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe" /S /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS2drQVVCdEJYa2J1T21KOXY1dDVwYS1CQ2lvajJVaWFrcVNPTkNSSzllNTM5LWREMVBULXFPVDZia1hZWkhWXzEwTjE0NVpTS1M1OGZZajJVLTlONTdaYkpGN0wwVzgySzJjSEMwaWFqMUtUVXhyRnE3XzlzalRVUXdEdldBUzRvUVlCUjFrTTB4QnN0OFBqLUFCY0JJSVl-QE1FVEEiLCJvbWFoYS1pbnN0YWxsZXItaWQiOiJ7RDhBNjYyNUItNDNERS00ODg5LUI4M0YtMEMyQkQ0RTQ5NjYxfSIsInJlcXVlc3Rfc2VxdWVuY2UiOjB9 /InstallType:MACHINE
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2256

C:\Program Files (x86)\Dropbox\Client_192.4.4605\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\..\Client_192.4.4605\Dropbox.exe" /install /InstallType:MACHINE /InstallDir:"C:\Program Files (x86)\Dropbox\Client" /KillEveryone:YES /IsAutoUpdate:
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\system32\netsh.exe
C:\Windows\system32\netsh.exe advfirewall firewall delete rule name=Dropbox
4⤵
- Modifies Windows Firewall
PID:2928

C:\Windows\system32\netsh.exe
C:\Windows\system32\netsh.exe advfirewall firewall add rule name=Dropbox dir=in action=allow "program=C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any protocol=tcp localport=17500-17510
4⤵
- Modifies Windows Firewall
PID:3220

C:\Windows\system32\netsh.exe
C:\Windows\system32\netsh.exe advfirewall firewall add rule name=Dropbox dir=in action=allow "program=C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any protocol=udp localport=17500
4⤵
- Modifies Windows Firewall
PID:3928

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.69.0.dll"
4⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\regsvr32.exe
/S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.69.0.dll"
5⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2976

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.69.0.dll"
4⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\regsvr32.exe
/S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.69.0.dll"
5⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:2440

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\192.4.4605\DropboxOfficeAddin.14.dll"
4⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\regsvr32.exe
/S "C:\Program Files (x86)\Dropbox\Client\192.4.4605\DropboxOfficeAddin.14.dll"
5⤵
- Modifies registry class
PID:4968

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\192.4.4605\DropboxOfficeAddin64.14.dll"
4⤵
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\system32\regsvr32.exe
/S "C:\Program Files (x86)\Dropbox\Client\192.4.4605\DropboxOfficeAddin64.14.dll"
5⤵
- Registers COM server for autorun
- Modifies registry class
PID:3172

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
5⤵
PID:1352

C:\Windows\System32\sc.exe
C:\Windows\System32\sc.exe failure DbxSvc reset= 3600 actions= restart/5000/restart/30000//
4⤵
- Launches sc.exe
PID:4212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell "Get-AppxPackage C27EB4BA.DropboxOEM | Remove-AppxPackage"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell "Get-AppxProvisionedPackage -Online | Where-Object DisplayName -In \"C27EB4BA.DropboxOEM\" | Remove-ProvisionedAppxPackage -Online"
4⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600

C:\Users\Admin\AppData\Local\Temp\6D709744-55F0-4FE1-B256-61879E840BA1\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\6D709744-55F0-4FE1-B256-61879E840BA1\dismhost.exe {0DAB2E32-9A3D-4688-A7A9-EEDE03E10EB5}
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3640

C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe
"C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe" /crashhandler
2⤵
- Executes dropped EXE
PID:2836

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNuZE9lVGd3UzJkclFWVkNkRUpZYTJKMVQyMUtPWFkxZERWd1lTMUNRMmx2YWpKVmFXRnJjVk5QVGtOU1N6bGxOVE01TFdSRU1WQlVMWEZQVkRaaWExaFpXa2hXWHpFd1RqRTBOVnBUUzFNMU9HWlphakpWTFRsT05UZGFZa3BHTjB3d1Z6Z3lTekpqU0VNd2FXRnFNVXRVVlhoeVJuRTNYemx6YWxSVlVYZEVkbGRCVXpSdlVWbENVakZyVFRCNFFuTjBPRkJxTFVGQ1kwSkpTVmwtUUUxRlZFRWlMQ0p5WlhGMVpYTjBYM05sY1hWbGJtTmxJam93ZlEiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy44MTcuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins3OEI2MTlDRS01RjgxLTQ3N0YtODdCRC02QkEzRENGN0Y3NDl9IiB1c2VyaWQ9IntEOEE2NjI1Qi00M0RFLTQ4ODktQjgzRi0wQzJCRDRFNDk2NjF9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7OUIxOEEzRjktQkU1OC00QUUzLTlFMEMtQkQxRDU2NDBBMEI5fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0NDNDYwODBFLTRDMzMtNDk4MS04NTlBLUJCQTJGNzgwRjMxRX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE5Mi40LjQ2MDUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJidWlsZGlkPW1haW58VGh1LCAzMSBEZWMgMjA5OSAyMzo1OTo1OSBHTVQiIGluc3RhbGxhZ2U9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjIwMTg3IiBkb3dubG9hZGVkPSIxOTg3NzI4ODAiIHRvdGFsPSIxOTg3NzI4ODAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD4
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1228

C:\Windows\system32\DbxSvc.exe
C:\Windows\system32\DbxSvc.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe
"C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe" -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ondemand
2⤵
- Executes dropped EXE
PID:2992

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /firstrun 1 /noappwasrunning /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS2drQVVCdEJYa2J1T21KOXY1dDVwYS1CQ2lvajJVaWFrcVNPTkNSSzllNTM5LWREMVBULXFPVDZia1hZWkhWXzEwTjE0NVpTS1M1OGZZajJVLTlONTdaYkpGN0wwVzgySzJjSEMwaWFqMUtUVXhyRnE3XzlzalRVUXdEdldBUzRvUVlCUjFrTTB4QnN0OFBqLUFCY0JJSVl-QE1FVEEiLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ
3⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:744

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:crashpad-handler --no-upload-gzip --no-rate-limit --capture-python --no-identify-client-via-url --database=C:\Users\Admin\AppData\Local\Dropbox\Crashpad --metrics-dir=0 --url=https://d.dropbox.com/report_crashpad_minidump --https-pin=0x23,0xf2,0xed,0xff,0x3e,0xde,0x90,0x25,0x9a,0x9e,0x30,0xf4,0xa,0xf8,0xf9,0x12,0xa5,0xe5,0xb3,0x69,0x4e,0x69,0x38,0x44,0x3,0x41,0xf6,0x6,0xe,0x1,0x4f,0xfa --https-pin=0xaf,0xf9,0x88,0x90,0x6d,0xde,0x12,0x95,0x5d,0x9b,0xeb,0xbf,0x92,0x8f,0xdc,0xc3,0x1c,0xce,0x32,0x8d,0x5b,0x93,0x84,0xf2,0x1c,0x89,0x41,0xca,0x26,0xe2,0x3,0x91 --https-pin=0x8b,0xb5,0x93,0xa9,0x3b,0xe1,0xd0,0xe8,0xa8,0x22,0xbb,0x88,0x7c,0x54,0x78,0x90,0xc3,0xe7,0x6,0xaa,0xd2,0xda,0xb7,0x62,0x54,0xf9,0x7f,0xb3,0x6b,0x82,0xfc,0x26 --https-pin=0xb9,0x4c,0x19,0x83,0x0,0xce,0xc5,0xc0,0x57,0xad,0x7,0x27,0xb7,0xb,0xbe,0x91,0x81,0x69,0x92,0x25,0x64,0x39,0xa7,0xb3,0x2f,0x45,0x98,0x11,0x9d,0xda,0x9c,0x97 --https-pin=0x5a,0x88,0x96,0x47,0x22,0xe,0x54,0xd6,0xbd,0x8a,0x16,0x81,0x72,0x24,0x52,0xb,0xb5,0xc7,0x8e,0x58,0x98,0x4b,0xd5,0x70,0x50,0x63,0x88,0xb9,0xde,0xf,0x7,0x5f --https-pin=0xfe,0xa2,0xb7,0xd6,0x45,0xfb,0xa7,0x3d,0x75,0x3c,0x1e,0xc9,0xa7,0x87,0xc,0x40,0xe1,0xf7,0xb0,0xc5,0x61,0xe9,0x27,0xb9,0x85,0xbf,0x71,0x18,0x66,0xe3,0x6f,0x22 --https-pin=0x76,0xee,0x85,0x90,0x37,0x4c,0x71,0x54,0x37,0xbb,0xca,0x6b,0xba,0x60,0x28,0xea,0xdd,0xe2,0xdc,0x6d,0xbb,0xb8,0xc3,0xf6,0x10,0xe8,0x51,0xf1,0x1d,0x1a,0xb7,0xf5 --https-pin=0x6d,0xbf,0xae,0x0,0xd3,0x7b,0x9c,0xd7,0x3f,0x8f,0xb4,0x7d,0xe6,0x59,0x17,0xaf,0x0,0xe0,0xdd,0xdf,0x42,0xdb,0xce,0xac,0x20,0xc1,0x7c,0x2,0x75,0xee,0x20,0x95 --https-pin=0x1e,0xa3,0xc5,0xe4,0x3e,0xd6,0x6c,0x2d,0xa2,0x98,0x3a,0x42,0xa4,0xa7,0x9b,0x1e,0x90,0x67,0x86,0xce,0x9f,0x1b,0x58,0x62,0x14,0x19,0xa0,0x4,0x63,0xa8,0x7d,0x38 --https-pin=0x87,0xaf,0x34,0xd6,0x6f,0xb3,0xf2,0xfd,0xf3,0x6e,0x9,0x11,0x1e,0x9a,0xba,0x2f,0x6f,0x44,0xb2,0x7,0xf3,0x86,0x3f,0x3d,0xb,0x54,0xb2,0x50,0x23,0x90,0x9a,0xa5 --https-pin=0xbc,0xfb,0x44,0xaa,0xb9,0xad,0x2,0x10,0x15,0x70,0x6b,0x41,0x21,0xea,0x76,0x1c,0x81,0xc9,0xe8,0x89,0x67,0x59,0xf,0x6f,0x94,0xae,0x74,0x4d,0xc8,0x8b,0x78,0xfb --https-pin=0xab,0x98,0x49,0x52,0x76,0xad,0xf1,0xec,0xaf,0xf2,0x8f,0x35,0xc5,0x30,0x48,0x78,0x1e,0x5c,0x17,0x18,0xda,0xb9,0xc8,0xe6,0x7a,0x50,0x4f,0x4f,0x6a,0x51,0x32,0x8f --https-pin=0x49,0x5,0x46,0x66,0x23,0xab,0x41,0x78,0xbe,0x92,0xac,0x5c,0xbd,0x65,0x84,0xf7,0xa1,0xe1,0x7f,0x27,0x65,0x2d,0x5a,0x85,0xaf,0x89,0x50,0x4e,0xa2,0x39,0xaa,0xaa --https-pin=0x56,0x32,0xd9,0x7b,0xfa,0x77,0x5b,0xf3,0xc9,0x9d,0xde,0xa5,0x2f,0xc2,0x55,0x34,0x10,0x86,0x40,0x16,0x72,0x9c,0x52,0xdd,0x65,0x24,0xc8,0xa9,0xc3,0xb4,0x48,0x9f --https-pin=0x2a,0x8f,0x2d,0x8a,0xf0,0xeb,0x12,0x38,0x98,0xf7,0x4c,0x86,0x6a,0xc3,0xfa,0x66,0x90,0x54,0xe2,0x3c,0x17,0xbc,0x7a,0x95,0xbd,0x2,0x34,0x19,0x2d,0xc6,0x35,0xd0 --https-pin=0x32,0xb6,0x4b,0x66,0x72,0x7a,0x20,0x63,0xe4,0x6,0x6f,0x3b,0x95,0x8c,0xb0,0xaa,0xee,0x57,0x6a,0x5e,0xce,0xfd,0x95,0x33,0x99,0xbb,0x88,0x74,0x73,0x1d,0x95,0x87 --https-pin=0xf5,0x3c,0x22,0x5,0x98,0x17,0xdd,0x96,0xf4,0x0,0x65,0x16,0x39,0xd2,0xf8,0x57,0xe2,0x10,0x70,0xa5,0x9a,0xbe,0xd9,0x7,0x94,0x0,0xd9,0xf6,0x95,0x50,0x69,0x0 --https-pin=0x67,0xdc,0x4f,0x32,0xfa,0x10,0xe7,0xd0,0x1a,0x79,0xa0,0x73,0xaa,0xc,0x9e,0x2,0x12,0xec,0x2f,0xfc,0x3d,0x77,0x9e,0xa,0xa7,0xf9,0xc0,0xf0,0xe1,0xc2,0xc8,0x93 --https-pin=0x19,0x6,0xc6,0x12,0x4d,0xbb,0x43,0x85,0x78,0xd0,0xe,0x6,0x6d,0x50,0x54,0xc6,0xc3,0x7f,0xf,0xa6,0x2,0x8c,0x5,0x54,0x5e,0x9,0x94,0xed,0xda,0xec,0x86,0x29 --https-pin=0x1d,0x75,0xd0,0x83,0x1b,0x9e,0x8,0x85,0x39,0x4d,0x32,0xc7,0xa1,0xbf,0xdb,0x3d,0xbc,0x1c,0x28,0xe2,0xb0,0xe8,0x39,0x1f,0xb1,0x35,0x98,0x1d,0xbc,0x5b,0xa9,0x36 --annotation=machine_id=54015c33-dfb0-46c4-86c9-75a4c12545c1 --annotation=platform=win "--annotation=platform_version=10 2004" --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ffc9aff4388,0x7ffc9aff4348,0x7ffc9aff4358
4⤵
- Executes dropped EXE
PID:1524

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:exit-monitor -method:collectupload -session-token:dd6d157c-17e2-486d-a2ce-10c27acf0876 -target-handle:680 -target-shutdown-event:664 -target-restart-event:668 "-target-command-line:\"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe\" /firstrun 1 /noappwasrunning /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS2drQVVCdEJYa2J1T21KOXY1dDVwYS1CQ2lvajJVaWFrcVNPTkNSSzllNTM5LWREMVBULXFPVDZia1hZWkhWXzEwTjE0NVpTS1M1OGZZajJVLTlONTdaYkpGN0wwVzgySzJjSEMwaWFqMUtUVXhyRnE3XzlzalRVUXdEdldBUzRvUVlCUjFrTTB4QnN0OFBqLUFCY0JJSVl-QE1FVEEiLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ" -python-version:3.8.17 -process-type:main -handler-pipe:\\.\pipe\crashpad_744_KVFOCCFZHCETJAQM
4⤵
- Executes dropped EXE
PID:3256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:4680

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /restartexplorer
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2052

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=gpu-process --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --crashpad-handler-ipc-pipe-name="\\.\pipe\crashpad_744_KVFOCCFZHCETJAQM" --crashpad-annotations="product_name:desktop_client,buildid:main,buildno:Dropbox-win-192.4.4605,platform:win,platform_version:10 2004" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4988 /prefetch:2
4⤵
- Executes dropped EXE
PID:2248

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=none --standard-schemes=dbx-local --secure-schemes=dbx-local --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=5036 /prefetch:8
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:884

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=gpu-process --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --crashpad-handler-ipc-pipe-name="\\.\pipe\crashpad_744_KVFOCCFZHCETJAQM" --crashpad-annotations="product_name:desktop_client,buildid:main,buildno:Dropbox-win-192.4.4605,platform:win,platform_version:10 2004" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5260 /prefetch:2
4⤵
- Executes dropped EXE
PID:2716

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=gpu-process --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --crashpad-handler-ipc-pipe-name="\\.\pipe\crashpad_744_KVFOCCFZHCETJAQM" --crashpad-annotations="product_name:desktop_client,buildid:main,buildno:Dropbox-win-192.4.4605,platform:win,platform_version:10 2004" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5804 /prefetch:2
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4300

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=renderer --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=dbx-local --secure-schemes=dbx-local --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\Dropbox\Client\192.4.4605\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4216

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=renderer --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=dbx-local --secure-schemes=dbx-local --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\Dropbox\Client\192.4.4605\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8888 /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2664

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=renderer --field-trial-handle=4976,6565711811627903257,17205889146656190451,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-databases --disable-gpu-compositing --lang=en-US --standard-schemes=dbx-local --secure-schemes=dbx-local --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\Dropbox\Client\192.4.4605\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10472 /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4128

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4376

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2636

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2424

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5780

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6136

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2460

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:5832

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4036

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6088

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1640

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4292

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3840

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5384

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4076

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3572

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4324

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5148

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5856

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3968

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5992

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4340

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4688

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6100

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5016

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5752

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5132

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5816

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5732

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5808

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4408

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4140

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4340

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4960

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4172

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4300

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5324

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6048

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3320

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e575a39.rbs

Filesize
7KB

MD5
80a3388cfe9ee9f6121e4ca183b82771

SHA1
f7b445125865027c38ee5659138a6fc9e184f76e

SHA256
730c0af0bb315bbb7b817290a867416cfc732b1801b4f0e24532c40b44b60098

SHA512
272ee7fea17d371a4512dfd6a49257d64c8ce5fd3b93b4b3d32b6b5681482287140fa82090546bbae73521f7ce445731eb3ef53dc10d581a0eaee0fd02079d08

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-black_scale-100.png

Filesize
842B

MD5
11c00e3a0c689ce15f91b956443b66be

SHA1
f7adcdff9f2351757b927a6342b030980d42ff5c

SHA256
10a723abb8c4fbfd13890abbb03ae29f6dee95af4897556f2e7a06381b10d088

SHA512
66b53271a8e30038016bcc53a3ec1c36a4dab12ca06602c4253f154e2ab07f7aebb56bfab7c917b8bbbbfca8e8dd1684ff5d72dff00d92adff6e03a6772e7e58

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-black_scale-125.png

Filesize
1009B

MD5
d68ad41c76cf57523b6d1d16dc14bd75

SHA1
538dcd5553f0cdaefc5eb42d45fdf95b369f5189

SHA256
34b48161fae3f477f775e9f3579c0fc55faf238a5936cf90c8d290b81a103001

SHA512
13ee8df4779aceb5e7b91bab190848d7796c5b9a550cdb34a347f829611f4e7a9c40dd42d7983c06a4d6dc25ca13055fe9d3e6eb1e9fb6a81aeae12a28549171

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-black_scale-150.png

Filesize
1KB

MD5
3619f4bd103b2a423e47f67513fa135c

SHA1
a3fbdb994a9920b936f7dde9111eb298b6f650fc

SHA256
86bef6bac9539ac4b2251554266e7bcb9a81ab2b7c3950c4b159adfb52a2d468

SHA512
eb19c738d74e72adb98ac995bbe8fc2710fae5b1d0d6e381c71c057ea19b0eacd79b359f48e484547205026c7b2a811fcb93714828e09d69442af7f3e9d4606e

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-black_scale-200.png

Filesize
1KB

MD5
1cc3e339a5f8576d819e83f1120452ea

SHA1
8bb1757e8a0794f1b02ef02ec7aae3b06847e17e

SHA256
83cce654db3fe11233cbffc3ff1db2baad2f7e53dc722a1a73283a875a012e4d

SHA512
747c852691cc2fb5d86361db291bd14310ef36f20496fd8339d2e575e7bfe04e99e5d0c1293a768c1fde50f558555a3765af675f9a986959c561879e6e63c25e

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-black_scale-400.png

Filesize
2KB

MD5
be84aabbaafd717c6faba2b31f25f088

SHA1
c6acdcde0a8b758165ba1a6a006ec0b920c70053

SHA256
9f071e3a27f710b72811405d974d95bceb0e93214f4163a18012a8e8a4c3bc75

SHA512
08fe1959827b02967a687777e7826d59d6e8c71b9cbb65c11a6db87f2bdf49fcf4cd9bb33da71acc19edd08a34c10c46b69420fd30622b480bb0c5274818ac20

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-white_scale-100.png

Filesize
818B

MD5
c00d891616eb8a11a03c51b4f4cf736a

SHA1
15c3590803e0ff99446d039be7f3b5698923b90f

SHA256
401dfffa0848dd6bc92699020b02c6757d3b9d4e54b9f7c85b12045ad832579b

SHA512
0701891f3b2ac273deada9878f0df5a14e651c04e9d13176006831a154d22e92b66cf41779a8335273e42a7bcf2c136724c432fc095b9887988bf926fa07e92c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-white_scale-125.png

Filesize
955B

MD5
e88ccce4b50e92561370518e5d8e477a

SHA1
d3e50b91b91600a189653a4396618e80c4e20ee5

SHA256
fce4249d823250d696cc2d31906277b99018245f20bdd0cd0f33c1d3d40cb82e

SHA512
e824eb1f0b5c8be5a8e406e71dbf0b832ff88342ce08e652ecef7bc9fb713428af65b6b1e9f158315087ffbd52892237e873f0aa61d12d3e3a9d1c815df91486

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-white_scale-150.png

Filesize
1KB

MD5
1f9c97394d24353ef45b7ff48a548421

SHA1
b02b4f4e13ab9f18bcf1b5cecc278cdeadf96247

SHA256
a28c376ce00aa77d75c7ddc479be2cd73e3d624eaa302d045fde48fbea01f958

SHA512
e5278bb105228bd73352bd2b0767b489b84dc774472fc2f3a8f7474745f9539d311a20f7835d36b74da2275df0bd6c61287e6a848ae8be65571f01959800afc4

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-white_scale-200.png

Filesize
1KB

MD5
5c387cd7a2a21fbed329ffbe087bc713

SHA1
09cad84a8379850d80ec04992f06dd5928186af5

SHA256
8a2c861f6cb067fe75b2628c44950457412cd8f717b00435c77043c068bfa9fd

SHA512
0319fe4f45f838803970e50f4c2f7fbba445b0b61079e4330c4b7026cc3e1b298919942756dbf2dade96ed15996523a24290c1ead20821397cd33cbeab229251

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.contrast-white_scale-400.png

Filesize
2KB

MD5
dbfe08c004475ac98216f9d4dadc1597

SHA1
0ab80ba37bf50db37b954e4192f5fa1762a2b279

SHA256
91227bbe5b1379b65a611d3c3909f15090191601604a6e3b4f753d22562f4970

SHA512
df276313a4aebd44fb6df908bd7bf2044f3cccaa27a224b6b4d0bf0d6d1ae96df664f8ffdcbc4726a155af4e35319bd4b45b16aa75ef64b58d3b36e1a621058e

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.scale-100.png

Filesize
808B

MD5
3da3506fcd8af2536c1bb3807c0d5566

SHA1
d382ffb999815e014282b8e175a0f201ddbe0b90

SHA256
49c9e1ed82c31479724ee6e9fded8be6f1d0af3ec21598433cc874b570e5be1a

SHA512
a0a233973fde4f714138e657a79cff62acfe41e440024dea806abc1ebe30702abc6c83a9722fe8f707030364fbb54362cd69c264d1d655a15d07de2378420dd9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.scale-125.png

Filesize
960B

MD5
5712ac86f757e4dd3fa9da856f3d80db

SHA1
cdfe9a08e5be63448b30b403b4a4a4a8fb74310b

SHA256
03cf02e09caf6da61ab2cc26baade70d945817064300305fb048714d35a7aa09

SHA512
dcbe9b3c0de2f92a3d6421e7f505dc0a87f8cfc47094d19340d3fd244a8c20dd46cafac63bec30898f1af4d4f0e50871c6ac7727f4bc402f9dfb88ebd058e6bc

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.scale-150.png

Filesize
1KB

MD5
7efe760736c5105c52333bb3bd6a693a

SHA1
59fd31eed792e820822a1817d52d3b97fab5abf1

SHA256
65faadc3a38b925583f6938b178914ad9b54b62a8c5d75046386196365594295

SHA512
d82ae4a65156ae2af66d80eae6c839f798ca15abcf0a78e6cd84575e270690ca1ab2f581a3ebbea926549dd06a9bb00a72886e6aae43877f5ecb4e13b5e62b17

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.scale-200.png

Filesize
1KB

MD5
c1aea8c3052efd4d1d51f26e7d0a3d9f

SHA1
817582e79117b3831625c6881d56958cab75e2b9

SHA256
ff8e81c6591dbe709022a947f590229c7a566bba9c8fcebf1fa1b03dea56c6fa

SHA512
ca1a854463968a25e53508599492976862aa657699b18793aa915c265c2636819822d5e29c37f2846b9f9eadaf04b4e4c1f37339858e565d1bc8fb1301a2ee4c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\StoreLogo.scale-400.png

Filesize
2KB

MD5
c1795adc1689608e70601d628141e011

SHA1
f596a4003cd0aeddd1266dab4a5539dc52fd91de

SHA256
c8f8705fba32eaabe20f654d42ab1eb3439f8a674d53a85d596df4d7dbb82b49

SHA512
9c7d6e3d0b306a43188c2c14d379b09f4d399a435ab48d170e98196affb4ce5a69f63c355914290a44cd7c890c6a24db979693fd123ad60c3957c94f005969e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-black.png

Filesize
2KB

MD5
72effbc784dac4b414b5ddb95973ce37

SHA1
56e0bf711a95146951043d8b11f4563644d75001

SHA256
b30e4d5cba1ea574459bdde0cc41dc04995e419b80e62d9384c2c5ae8d86ed44

SHA512
ce4151117dd25e52c87ee5e98d475a1c42ec1a7e0ff6fe10b5429b2f4ee664db59c5085e1b2e17bcd722d99851287a5aca898cea5c648ef6ead2a3dd71968505

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-black_scale-125.png

Filesize
1KB

MD5
ae702fbb30de8caf575c3b556b4c4bb3

SHA1
20cdf6391cdef569f60a6ef8099b4e54d6a60369

SHA256
744bf505b69bb0de1cecb1054e06b436ca91b0f4296c4240e186f5c32ba9468f

SHA512
b8e05b737748e5e77dc9e314c5bbb62849186315d8ed02e2942e7d0e8b1d5c4d5e308e36679ae4d00a635536cc859451a5727ddce0ee4019958c5a9130c22480

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-black_scale-150.png

Filesize
2KB

MD5
75897c2760966040bd1551612462035f

SHA1
5022c9412fdecf1f76b838791651f8e9d394327a

SHA256
316a375a222d28e5a371e193881e5fcbaa72ab58138dfb54b8a75f7fb8438454

SHA512
821c7bf9b850ca2c054310da76eb5d9be695beecde1f800da2e03ac0aaae0292b1704675370d78a71d01a1d94ad447f3fe455cc7dd556c2e9845b6ae0b8e7f4a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-black_scale-200.png

Filesize
4KB

MD5
298fb847070161b2fe16f41d9f75df94

SHA1
f2a78544ee10ebe6254a2eb55eb0d22227886042

SHA256
7fa2beee1c84acecd66b0f34c4dc5c22284a376c5cca1b4bbcfa21955d34e0c3

SHA512
b87c8b851ddd039d4256d08dd278cdcf32b66bdd65db1681ddb045edc56880dd6298653d381077c6558c33e8df291df6a69c3681dd2259fdded9db1ad6a98eba

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-black_scale-400.png

Filesize
7KB

MD5
3ddadea7b3a8a24ef953ca7a632ea48b

SHA1
d8dca786084e1c9efb6356572734a59bd437b580

SHA256
d966355f02930ea16084a6d9e750f3e4d6cc9c0960a3d8e3c00543a1c821e3d5

SHA512
7f37de3a7a6949b14f09a8e4ef3c8896a4e0a49219531b2cb114c6ededc5686cdff49bff51b032c5ebd8bbf5639833116244a7bfee83799adf1e0b3cd6fdffd4

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white.png

Filesize
1KB

MD5
15ea8f10342e747e88d35cd937938946

SHA1
bc4f183b55177f6dbabb446d9706f3115a510932

SHA256
8cf1735955eb588386eb404304efed2b13e193b294d8a851d343834c04cf580e

SHA512
75bbfa30edebb0f388c2e1456b9a9182087c3a51a35d5293dc3ab8da9368a30cc9d91f75a99e5e838bb09b251dbb762ad6d0c2820388aff2a87a1203ff16d0a5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white_scale-100.png

Filesize
1KB

MD5
aa4acd95731cee7404a6b51b5fed0918

SHA1
71f5083178f57e5d7d154885b7fa14f314492420

SHA256
dfc2078b5f36adf8815e31918655f339b0024edd3defff09e2c084a0fff890e8

SHA512
d38631979da2d5d79d8aa1b427540efea857d6dec063a81b6e431b24a2f1ac902b2d21157dacb4aa866529c0bfb37fea7a3506fb31abfd21b29e0f592ccc5a15

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white_scale-125.png

Filesize
1KB

MD5
d86429ccacbc7580e6bceb32e285342d

SHA1
ed581db14a77394473f196e00387431b3da18898

SHA256
3ce16bef87a29a5bd597aa6e1910170f876633647859e0e95f3321554e581ca0

SHA512
42dbd41492b24d8f08e06e41db582a676e0a756d8f5906a417f10082b1cd887d5e5734bbac550e7f066e2577d5ff41970075d404b8a6ad20438fd86603db5331

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white_scale-150.png

Filesize
2KB

MD5
38c229191dd21806c83ebc86088216f8

SHA1
9c2afa9f9c5f0cc1b7658d1aee178cb09b4e3f2f

SHA256
a698442e659f4620b5834f8e2c5ad4223279452bbc2d91aee0c625c6a59da0f0

SHA512
2db9a21d62bfd77e02c6e05bf866179c849178e851f5c5daf455fe6ef22d1e059f74477e6dae6967fca67d618f79bc3be0dad8e61ec726d6f7c4882c69dd2d0c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white_scale-200.png

Filesize
3KB

MD5
aeb784af151273742ba589d39924f69f

SHA1
fde89b4f7008633606bc9ad27b9757e17b0aa491

SHA256
26e1fa2a2f0aca1b344b2b59abf5663d6cd4f7b69d0f5d8d8d9687e52593eca9

SHA512
0f938c6d7a101e10cef7905670a9710692ae9e6b0966e15b0bdad6175dceeaaaca7f0b0548a29fccb4295dfb21a9d57fb509c81f6c5c600c9410a7a0c12c3fca

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.contrast-white_scale-400.png

Filesize
7KB

MD5
6a8d19d3e31c2fb21d4bdc1f2e77e60e

SHA1
50b6236844090095465f85f1341a323d7aa4a57c

SHA256
b294930c03b6d86f5765e650273c9d2a7b90bae3e4a7d63b6f766914f3bff5a4

SHA512
2ab9ff1fb16418598f9d5392e7707109fa922799abfa53a642040fc3622289ecd0b69e8d617ffbec1b4198841972e5ff6cf4f18e57abb24c2e340c0a610e389a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.png

Filesize
1KB

MD5
645c36ad987a44815982891679635145

SHA1
9dc5396d7a569d009d32ac08ac343559fea113d5

SHA256
7b8d04dbc781bb2ef7c6697177f41ecca6d1abbb9b6264700d1b9da87a7c4e38

SHA512
e8444cb16d2584508a699fa0a0f9afbef9325a505ccd56df5571a59875f81edb4e7b7518f197e879be7bc86e8206aacfec8977f8ed73ee65294c586442f941a5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.scale-125.png

Filesize
1KB

MD5
1f34876e482c13ddd4aa5a49853d9027

SHA1
c6da51520748c60e6c1836ac37138f17dc289ac7

SHA256
46f36c5347b394635317ba6ff0b436c63c0bdf50868131f86721f98fe0dc834e

SHA512
3c1965817bfbd13972620b4a698d222edb0050ab7b6f1ec372fa76f745b1f6744f21eed4c42e8684e27793711fe4ced0ed5677f097df2a05ad215728b68cd3a4

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.scale-150.png

Filesize
2KB

MD5
439f78de7a305444f35ca2d9194bd1d4

SHA1
53fd70a48980f927941da2814ad812b1c7c3c1d2

SHA256
4dc436394ff2b6f66c846a9e7499f5affb49807babb36b082b2a39ac4de4f431

SHA512
a9043fbb15d644b131f49ef89f76d1e83d5a835a0fa5b4b41696c5268fdb3b4b183e9c2353e9a5f814f312a11a5c4ab6bcbed6d8ecc2fb41b829a5d4077a3bd6

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.scale-200.png

Filesize
3KB

MD5
fe976bb56a61312402a971553a5799cb

SHA1
d55c2ce161c84e66a799d7dc0d798921e2e22e2a

SHA256
d5b905ff6d4888479eb587a1cb0c4b291a7b063002cbe252e9dcf67886433e9b

SHA512
7030cc5a4b30fcecdfe495cadd5ce409a72e883e4a51910901abe3be12872fe96d8c5db17d0e1e9788d48ef679ebb33d3491f7c439c938b43b208bbdb5862fed

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TileSmall.scale-400.png

Filesize
7KB

MD5
487353d36065ca5b61eb582b5f10c3a2

SHA1
95eb806e601663710081b75adfe1e9023bb4f8b9

SHA256
2c02fdef716808679b62e68774603b383ad8d18dded430577132e1188218891c

SHA512
753713dadbd952c1ed26032977098137027ab4b997dbb406377f634d433015e4ae1958375f024b7f71c5fba5ac2d4256d8a4a31a487f4125560014ca9cd27b38

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-black.png

Filesize
1KB

MD5
1cc3e00ddedbfc96d1bc4fba575ef45b

SHA1
540257c36d64656febd7eac22ae2784da3af55e2

SHA256
39fad5cbb4e4cbcbf7ae6f319536f09850814690bb1dcbe319d1e733a4577e7f

SHA512
65b14e4613e69ed3d062bac0ab10f0d0990bd65fc10593d7319841a0898311f08a37c7f0bc2d83f970319b3e439eb052d14bd18b91d8e10147964b3f53a94cc5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-black_scale-125.png

Filesize
1KB

MD5
022dbac1c0f85005a3df0853bfdef162

SHA1
1e443e8108ed2702df2c95794f0d7dbd61cfc840

SHA256
a0caf8f293aba7045dd603514e8b0c4303259ba3e2ac3bce4711953ac531556b

SHA512
92af813512549c76c8491021821156f907a60f505a448cc5efca68ee7a9804b4f5319506fd0097c28dc13312108e8a6914fc3d80f9a818b160febc526f72cf31

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-black_scale-150.png

Filesize
1KB

MD5
caa561fc6f09c008f8a8a7e25158a622

SHA1
c6d21cc72d247bcc736a5e20c8c5c04df394a93d

SHA256
fa59094e662ea019895bcc9691918feed1c5f4059fa2a993344cb4e2dc428aff

SHA512
f5ab6db96fbd155510275fa412f11700379229609e8f026c77866b741fa1a5c6aaad058f1ec0a2d4906f3e10266dd0f2196474b6b4c1d000641dc6ebcc14db54

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-black_scale-200.png

Filesize
2KB

MD5
2f8686fb8b5ddbb37ba7aa0b7b8854a6

SHA1
4c3b21f8eb9f8ae111fc66df451889ed4afc8ae4

SHA256
9319fc5f163cbc9698c3c8618391341784ba450b847bf34cb50d9a6f18cdf8ca

SHA512
3cdb34802667be547dc7007fdce8608b49a687a3ec9d3071b023a4f1f3e19896d09bdc46e19b86af7f690a42246ec7fa46a54bcaaab062e40f4542ce70b44f80

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-black_scale-400.png

Filesize
4KB

MD5
bc5b741c439190cc8716e10717ae2590

SHA1
d3dc7ed9a1cf94d5fd71efa91b0754f708ebbc4a

SHA256
ba6353451658887bb758b97687d5cef9e5f475cd1d997dbe43b591e80e1c32bd

SHA512
c39fdc9d854d7d51fa3e99728708bfee36b2336f5a420bac07fc451ef6515e587af8007839c3583de6138042f1d2775931a7a009f152b62e5bd0b6f4621d411e

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-white.png

Filesize
1KB

MD5
6a3cd7d6943756adf70ccb12eaa0f913

SHA1
f0c2290ff6e7ce32c64e28a2cde832310f9dbd1d

SHA256
ae4a90f3837784aa05a9c93cdf1afc4bdfab944f26e924ef8d60093063fe3d1f

SHA512
4ec794914649cb9ae8e194d2254faa43334d898650733c03c1fde96d42cad2c898f00808980310c05dd24e0f7b6b791c1052c74fa0da2bc2229d432aa609822a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-white_scale-125.png

Filesize
1KB

MD5
ed607d0afe0c2c4664a4c96b26810a9d

SHA1
2dbde2f46c9638fbed3a1d8640a482a55d89d403

SHA256
34599c2249279d48d3da628ece3a080b81529768c33f9c35b4c9cac730b40270

SHA512
ea49fe368bf76f100178be6731fde8ef15d6a52c7aeaf0bc1a6b5e3e88e84d7deb5c68af18501db13606f3047d891947c61a8d37e54eee6df3b8eb5f86de5363

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-white_scale-150.png

Filesize
1KB

MD5
c16f5664f04456e3be99b838cbdf237d

SHA1
279a4f8fe360ee74609d1bb069472dedfe484237

SHA256
266019879888a5c9d275a6e56c86b9281fa0232b4b5a5c8f7a72d34196e3c593

SHA512
c532b0adb11dc9f0d2e117b796483da746f8d23c95810d0818672122aec05fa51c608f45ee26703d374fabb5e98f4a8fe7329c531547e8255cd12a49d7524573

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-white_scale-200.png

Filesize
2KB

MD5
3706f61b57fc7819c5ee10e2e9bc216c

SHA1
ed6a0fa9a5895ad04a8b6909cd89b3ee1322d38d

SHA256
356544638e33837d6e903f3c38e03d0b068e864cc2700a457aa42ebeeccdd06f

SHA512
d7857aeab0da8480911059e406bd85dbcfd356ba0aeea550fc44f592053fcf4cacc0faa1adaf8c83c4f91b5091270410f3eb3959527f5940085fa77149d69c11

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.contrast-white_scale-400.png

Filesize
4KB

MD5
da0780e4d9ce3da8f11b424ab587eedb

SHA1
a8b49e160fffb594b613cc24ba6a8ad9ec254a71

SHA256
9195c995f3a72b88a0e7497ef1c6a2e10c6ba8a3b5c7e02a793e7f3bfb6bda2d

SHA512
53dca353287f8b496c9d72ff5d198a07bd6c24d59040bb2bc7ccef52566cf1ae3de4f29747b16f7766d500a2316b7b54912c622270d0cd950376a2237e93b02e

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.png

Filesize
1KB

MD5
185c0fed630b215f22a800d49bd1f449

SHA1
17380675ec0f35de43e5927ddfa86154f1574c67

SHA256
561ca42a1519c230756e7dc551329da441e6e7789f6156f7ac515be094b1ca83

SHA512
b034afc68d6b0846b5546e1b29847bbd9b4c041e15c2bb5ff61e0129c798c871a78241e1dd263bd0182a781fb192cb9b621d978fa4090c519e1683d6568998d4

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.scale-125.png

Filesize
1KB

MD5
fa50b97bfd3a6755d3809dd27198f1ea

SHA1
bcb78947aaf227c4f291bee93e3c1a64a4410e1b

SHA256
b4d0fdb3e633ae44e5ef3a2cbd07133a769c739e71bb7eb6fdc52a93553fe689

SHA512
3bcb6fb9b9bd1635d9f1d74d07038c7a551e2c0e5c2515cda2f380f985aa7d930bb543e493423715557884a8f9a1e394b39b7d5dbf67538aa29bfcfe0b055d6a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.scale-150.png

Filesize
1KB

MD5
1ba44cc71200f489ffed2e83918a3160

SHA1
b3d2b8d61223c91d803dbc72b4900f6dc0f38d70

SHA256
d4a16dba610e11cf827019dd79a32312e2da9d822b97b96200b52deaf7f899db

SHA512
721780009f0cf8743e00d03e86242c09927a93b99561bff98b841a88c4579abf1ad98d48e44d5bed74143792697a403ddf9e2d8749fc40414b0be1b971c74085

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.scale-200.png

Filesize
1KB

MD5
7c7201689dc8ff0f095ce9aff764c3b3

SHA1
a9c6e6407b02597cd5691e3057ab0049d057709a

SHA256
e596602dbdf5ba148d9f3cac6f4943fc93d3141afe8d32ad1273537284ad5220

SHA512
87fd32cd0af8562d897c77fa92d96a64557f8e52e513a8ca2cb82543c8eca6533c48b6db2ee530936f0cc2af466fa6c3e9de1fecb035c2c48cfe947eedf8ac69

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\TinyTile.scale-400.png

Filesize
3KB

MD5
fe4fb7aa9c08e6b531eca4c6b2b15828

SHA1
4e081d7c6345fb1de2995efefc67b90fcad70c76

SHA256
31417e5050802908b26c340730219731db5c359ae27f60261e750e4260ff5fbe

SHA512
37039e7a55f07d1f05033759ffe08c55344caea6d23ca9fd4612d5da45d300766d98520d31310a19fbc82ef052ae850358bd7b76a5b43f259399fdde58859208

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\backup.png

Filesize
6KB

MD5
1521c0a628944271f2bc1e19978913db

SHA1
62dcff433a57e17a24eae81638744df31068f693

SHA256
5bfc58e4b27a8405effcf108856d2650299afcf55eab83e95370c9b6066709b0

SHA512
39c0b9ab739bb777ff1e2c64d71e910d6859f50f0b0f243d34610f30f4b312185ae70f715880b4918b272f01e51e5be127f2b40c37cb3419ca3650c2248b66bc

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\binder.png

Filesize
2KB

MD5
873fbb8d6c4031515ffe4fa2fca98f1c

SHA1
6647f17a25a2e11e8b43ea057c14d77d8b0485c8

SHA256
f582ca6fdf085b23240b35411040b0b5bff6c2ec1ed5b2c0f7add35c88c65914

SHA512
1c29ccf8be145285a85783b979294af651582564d62839766c549d9a76ead223c7db73abe2de65fd30fbc30a174c14677eea4f4258374cfeb519b5a2e75ceb09

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\external_drive.png

Filesize
6KB

MD5
2c5ff4c40104d73684602b8822502e79

SHA1
bb8034e2603fbd74408239b733e47f2fff668d5f

SHA256
971d455f91faf6bf320ed366f0881fc613c3228daa9ed91e0d6c864ece1a735e

SHA512
b4270bcd6cf9badc7ba7343760863961da179ba1f87545e61c27f37b4d652cf0333c5451f7ffc52628ba0d24861d6a692d0eb9d3ee247511a735b6f7b5f10743

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\gdoc.png

Filesize
1KB

MD5
380d7a105141884a3a4369618ec809ca

SHA1
c87753703e478f9b1194990e29c25315c0387db0

SHA256
4541fbe81bc51114ef18706d2b37a44c1c5ba14454fc26b8a058bb31bd8cfb79

SHA512
40c16d9281d74b47d197d103e7ba52ca2fca30811389bc2a699f4ae9fa30ada55e6327840c43cb3139231c3f7a7ad841d7154950e6258e806e628115794574bf

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\gsheet.png

Filesize
1KB

MD5
8029ccc1e62854e19c74582fdc915634

SHA1
4dc6094aecb1bfdf87cdc0123a2f1f905bc83df2

SHA256
70f5bf52350b6aaf67ad1296a947ba2a87c12dbbef76d1c3f73fec723977a81b

SHA512
f37822df1dc52e955b990b138a88064edd92d134773c4dd0950e298ee7f8812e16cdfd64f6511c45f9618c99d8343ac2b973f67b5a852bda0e4c8f267caf6d1b

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\gslides.png

Filesize
1KB

MD5
d698a0f00979142b5991ab54db41ad64

SHA1
ded38ecebbb506d1b8b719c57f5ac8614dded702

SHA256
c6ed27af06f6d5e565469d95bd7ac077418971bb1dc7f2fe068d07cf0f84284e

SHA512
cadb690d88987de1ce8ea1d1fa2f93e86e6ea093a9623f5bc48d2f8cbb6e29d05525d358595902a0179b516b043bede63e2c7df3313a2658c84d2dfda0af0536

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-black.png

Filesize
850B

MD5
b832b83311da4c4ed1ab6841faf9e095

SHA1
5ec25bd5ce1914ee348afa22ffa79163b59b644a

SHA256
f1169f6b53191be05946e9ced0dbb6676b61ac9902db3218e69eb5ed4252d67a

SHA512
f5895b26b61d31046c97de5ba04d2d18587941c3e39e85e2d9a2de3bce7bff608011849dbea1982e4a2401e1c4b0a02c566e9d63c2dcfe3a2b69ecf9a473bb31

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-black_scale-125.png

Filesize
1KB

MD5
990a230b37c6ecd355eac8e6b47190f7

SHA1
c1be5515f7c2779a0bd7e837ed97b433d2d908b4

SHA256
08a92e353e5c573045edc67b2c58fe245d5ad40c3c3e63edcf4ebcb0f1efc5bf

SHA512
68e52f6ce78e91b01d06b06b51d9930ed413f258f53447d0b394dc5e2661be6e51bcfe25cb818f3a1c55385a3f9d8e695c4d759fb2d677b18822f89f8d4e607d

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-black_scale-150.png

Filesize
1KB

MD5
fedd073d6396e035e8cca6e7d38bcdb0

SHA1
2c686dfb2916c094419481c2c1f70fd73b2ff944

SHA256
bacbe3c51cc9b59f42b3b5e246d9c2e3843a08369d7551bfe53e6542a847e9f6

SHA512
93e48632646b930a4984441cd29723e1272cbfd5b005e38459dba831f0da7d530b1a9da06da8d632e75cce62a8f3ee61fa36b0dfe0ba9a74641323145857ce2a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-black_scale-200.png

Filesize
1KB

MD5
040cd2d93b51d1ba57d7b98cadfbc5dd

SHA1
cdc1c3bf0a2a916bcf474927604c2e4755f0c5a0

SHA256
742e2f2a19e3158f1df75cbac15400b9ff4f14e6f4cbea5c856d1a8e07d52cb0

SHA512
18678967c92ee3ea29c4169e8ce602795e9908fac2e6a113d87e7f67bf74779f92befe732f6be201aa3f70b0edae8b3ce845d1f857fc90e0c6a82022300cf3b8

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-black_scale-400.png

Filesize
2KB

MD5
543d527e790ad5aadb487c3dfd251d13

SHA1
11dde867dba701cf21998165e0612d0c481f590c

SHA256
a722bae20339682d00edc12d01930b8ea9670d3a48f4e85e5d8c483a2f9f3f6f

SHA512
7402b45649d81e09e7b01a24f6cb73e0c10ff120715f57a803959d9cf3e994178f363fd722c604c7b6a942e54d860ba63dc1d7050a706b8f1595c0bf0eae08ac

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-white.png

Filesize
829B

MD5
5667327e1c37cac08cfb45f4fa04fa16

SHA1
d6ec47f3a5276a4081f24922b9510e691bef098f

SHA256
b483f895037bb12a7d9f4678382479abbfc67a898d5da76606011d133e119396

SHA512
319f81c5023197b1011f58f074ce7aae81210201db56f7af21d436c710489511c17a02e584416c6787b1cb31e06b67dcc232700b38994d2e1dd1db402f3f2095

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-white_scale-125.png

Filesize
966B

MD5
0c932b40eba76ff9015a1f55a1dd1776

SHA1
e25b4506a79eeb7a586c811f6b5e626df6537cc7

SHA256
e8449b860cf4eaf5b894a606ca19951e4ca9561e0dd2e8a82b142bcee256a846

SHA512
52f34233a3e64b4beba4c8d268a1449dab42fe68d3723651d8ac80d7a5d7a4935f5b742c49fada9a0ddef3996415f99953df5088a68f1483cfcae08e9b610428

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-white_scale-150.png

Filesize
1KB

MD5
47045326a56d0055b8836a65fcba9fb3

SHA1
8d9cee61331c9a333cb205e80c0ddf521aa7c9db

SHA256
e59ab89cdb6a4e395e43abd6de2dc56a8a198c9250700505cdd7da8bc70e1814

SHA512
f16c95f2c664d45f5297bf465f16cea72bc89bc70faef01807255c2329280dc2d0709d5ab6e7fdf8b6a612aab6ba3d2cc0e65fbbc4e3195bcb1b7d5dede0ef2f

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-white_scale-200.png

Filesize
1KB

MD5
c065e50cfff6d79e0eb9f2c59d2e43fc

SHA1
2682657708ec6127fee9b07eda3db186fd50d76e

SHA256
72e9a9762f27b239382346341733aae6d3fd8cc87441dbeaa92459197f7c4b12

SHA512
9021af1b1fd24847c956621574108b57183d3277688431bde5a88d76a259f25796ba4b1a073863fc86c5f439fcd7efcc60fd649852565710dd97e4a8955b9c13

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.contrast-white_scale-400.png

Filesize
2KB

MD5
c28c3dfc76fe1dc78e1456b63755bc1b

SHA1
0d2602773d5acb84403bb611cb2a68f535b50c0f

SHA256
c8db5c7d9e4196500a6707a22af86038af867a16810d079dc0bd7ce9f2209997

SHA512
cee3a729b01fbd324dc60f1753b886ca65cd54abc3e10a9b93b50ed1df1532afa642deccced9ef98e4130e71b628aa9de7b0b65333ae6a078658c27d16dde3e2

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.png

Filesize
807B

MD5
9d05fc2b1d201d34a32f9e0fc7fc6b28

SHA1
b74925f23d9ebbf9a170f0f6ee2307277c535be2

SHA256
5b4295cda56616386c8a51e9950c4b6bf881da8e38a3b06af45dbc383efe2a9a

SHA512
073a84635557810b0fb8cddc5b54c8afe6cdaf2af666aae5bf4ec89ab79f06367bc4e5717538314faa11ccc6ae619f7a3353a878f32cfeebabac99c545cc55b9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.scale-125.png

Filesize
979B

MD5
2145838d099c7880f0573d14c04ec9f4

SHA1
337a3c7c9d1c7988948003578579816f118a9a23

SHA256
993a57d13e17efeea8a4d82a2c34e1366370d3ffb869e1f4bdfb7eeee7e95713

SHA512
d78f646c90dbe2b8f7bfb4f9d80d68437f1408974f4af10ad6e1fe265419c549b2b38021ae951d0cabc8e9948dc0f871bbbc2a4cc5a1cc3eabb574f66eaf12ea

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.scale-150.png

Filesize
1KB

MD5
93f4aa125f52d7d5dd00087c94ccfb0b

SHA1
868dc5709f0d35e94f3e4cc94e92715fd912c0d8

SHA256
12e29e0f3c411aab7cac939243217ec2cc5d2e704d5e2e3046fef76b1f9ddc08

SHA512
f3ada2da513d25abcf786db93957a0f00725922ceec6e20176dc1f2f738176b850635bf2d98855815b019ed0e4567ad198383d1fa5efa340671fc68b45cb7362

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.scale-200.png

Filesize
1KB

MD5
c2ca27b8c83cbe7530b7f2002e9b05d1

SHA1
5e9ab52d27a81ee5053c99b24a822be69373c10f

SHA256
2470fbedd07761a881bc3ba492eda9b7650fb6abc5fac62014cd6afd5837e60d

SHA512
36b50da360017745084f8d4b80c335589b39ea1d94f11b6b48a8c155ccddac1095ca8600d26af0babe4bab07db199b7f0dc92207ead76007628f5b6d240938ea

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.scale-400.png

Filesize
2KB

MD5
667d502039a4d46e9d612a9a7b35ef7e

SHA1
0c7dff244e11cc23ac1732ecc0b6d77841a6f348

SHA256
0e261e6c03acabdffe199b1f06358fb5aae4581503166e824ca51f641ac5c821

SHA512
d07cbac3c1859d1fc87791207d5115576d74c94e79adb25d566dadff3da6f3d5ede8b04097008b3558d6916dac2e68e92a84a9a663b0e5a5fb4b68a1f06036eb

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-16.png

Filesize
369B

MD5
65314a1f7cdbaa7d2d54e55ebe01f6b2

SHA1
064dda6eb14cf6502ab501a31c61ecb2749dba3f

SHA256
480bd88e54f2f39583b7360b7412486067dc8f0acdfb9396ca4b2571349515b7

SHA512
ac0e7a59de1c595a107e2ff0c044e27627629c3c9f66cf40503a9e4d3252577f8db75b60fe777833f391165f1fd0926fadea2fef71810292e6a7365747bbbcae

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-16_altform-unplated_contrast-black.png

Filesize
352B

MD5
69425172b704c2ae99ce43d4c2ec3e77

SHA1
55b9ca414b419377c93d799385b1e5f17905a6fd

SHA256
768dedd2f167c28e0e628326fdb17f9d0a3b50d2776600968ad00682a6a84de4

SHA512
26cc0ae704ed6abf31eec3d99425b70577a136edeeee252b43f2922e871cf9427cbc4566d1dcd5018c0c5ef2e8f5ea2eceb732ac696b744cc0e1a880afff5ee6

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-16_altform-unplated_contrast-white.png

Filesize
382B

MD5
078e5ae7004ca5f443d3a92627caeb8f

SHA1
c03b04cb32d3e7f24aab7a4ce2bda96820edadb2

SHA256
7fcccb4c85dcc54849c88d74241db75e5174160e0e364558073d6e6c01ad107e

SHA512
691f3e8b09449c5663f0ca5b0f71f1d4cd10997c361f29e2e5be7b577253d744c2a4283a61cdcdf873718d36281c63e3dbf21703198c26d389037184419c54a5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-20.png

Filesize
433B

MD5
08fff0895f5bd8d5a347b441e48ad41a

SHA1
b9331637e59137bb8d75251bf85677099a24ca27

SHA256
92ecfadf6d728ab3346f8498bab501014be35881bb605d585209033c0c8738cd

SHA512
64ee594903afcbf3848ad37c094be60815104ea0aa17f5e287600448e95902e07820ed0bb6b840ccc78a3b60d8b37e7dd4c23e322670e588b8df21a3e0cef56d

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-20_altform-unplated_contrast-black.png

Filesize
429B

MD5
f568f4b386b0e96165f0bea8f20a2f90

SHA1
0dbb7d102401e27e01bed8bdfca59103931eef4d

SHA256
fc27012a9f08d137a192e4651fe1170348fba0e755bc20dcd18a040761764028

SHA512
cfd190ef7b29d0dbf461517726e8e179b07bff0f6e5be0a1b40cdc4f89fcc1093b5d79ff319b2231c8924fbc017a9e2e98a510fb25923be2040dbd6d1a27d060

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-20_altform-unplated_contrast-white.png

Filesize
424B

MD5
8fa8d6175c2e3cd8b8c5a7174c872490

SHA1
3c40b505d69bc9a4d8115caa6995a49a8c652c6c

SHA256
9ba3a66c924c24287fff271985cd9cbc41d98ea3003ff079485ed16096b40af8

SHA512
88a89452f59e1089b19090d2cd7981288576f0929a0e5598ef6b60b828e1986160bd0ca1e4b1f73cb43ef9b5605ca4520c353f80135e0824c86103aa539132ac

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-24.png

Filesize
549B

MD5
17df27edb43d66bf07ee73f901bbc036

SHA1
fc2c1f284c008754d73284eb41ccb6bc13866366

SHA256
b1c4bb67f7d23a1f7c7a336ffd7b6c9eac64d166c62c71f01900057acf6ffc97

SHA512
a9996454106e500fa29db69b1fb234f23bf2b64906b316a53e675881b7c97f652f510ef8e86306eb6ee4fe868f55013a9d855b42ea5aa35400569203d49cd4d1

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-24_altform-unplated_contrast-black.png

Filesize
545B

MD5
89b16af41887fa5d59d6d4196736412a

SHA1
89837e2da2f33418f63095ebae076cd42d3e96c7

SHA256
962a367ddb4e1a3c1b4d15c5bccb26c8dacdf90874709b2049137c6611cedbce

SHA512
f45e803282ee568be2de32c2f82d3a0971d4bfb8b9c1e45ce010b01284c0db13f8da30a4029e7d32834df097b222b7899b559ccf25a202c91c9561a49a727989

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-24_altform-unplated_contrast-white.png

Filesize
525B

MD5
eb8547e09e4cc9c9bfe3d22a5bb030d6

SHA1
e971788950eec3ec33d42fd1884ef460beae7b4a

SHA256
fc2025e7019faf3c3e2f6bf953710aecd4d77eb3a270c301e14acb056a3f5e41

SHA512
0bb2029260147f4d1041e9cb4a7696248158992cbc0334ca09ef433c1fbeebbfb667edee18f1ed2518383883f575eee8e01f0948e3075166b34120f42b8ae2e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-256.png

Filesize
3KB

MD5
05178135c922f70c73c4bf161dcf30c4

SHA1
740e84bac96b585837a3680025f31bb41f5574cc

SHA256
017de63c54a90a3fd5355ccb74b1030d7ddbd3795d17d5531d8d3b4925d09e5f

SHA512
07bff7f3cf5e0cd6c57e4ecdd42d91d8243261a760592b971bfd51170a88572447cd43bd0a7676136a56f8dd8ef4e25e2da218b9334c93a6ed7dec3d62883aeb

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-256_altform-unplated_contrast-black.png

Filesize
4KB

MD5
19717d9e418bc3f3bef1cdf2f5df2ceb

SHA1
dd703ce05d68c79f9245f85e30631f84a619a616

SHA256
db7844bdeb530f730adcd6e8133c0268bb4f623a126cc021d896f3bd3b5bbcc3

SHA512
bc81017ab7baa23d4776dc24e27823208b59406e374211b455220fb93a5817eaa18372cc00ba3b13899884f5463a0dd088d233c6f9effebda961f0dfc9c8dadf

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-256_altform-unplated_contrast-white.png

Filesize
3KB

MD5
b001c9070f08bb5d0fd365b5e2cf20d6

SHA1
f7e19e04b4ba0d2ddf4bc1bfeb294549193900a1

SHA256
00c062d5b17bfecc284c1a2cae4ab3982475726be67fcdc031051a2a069079f2

SHA512
576d34bd5d81b19dde57105804b2bbdca0faede9275e8c1cfd9707edfcc00bc5ee9add3f08865e5827e9f143c798ccca8ed002f1995af8bf9473b237ccece2f9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-30.png

Filesize
634B

MD5
a8dfa7f601b7943c10d2629a64400874

SHA1
ca14836647c3ed3e23b8ccc1b14113cc949b8ac4

SHA256
0f1d81715883c6335a6cd9e7d5eef096ffe151844c0754e61ba5051a0d3fd6d9

SHA512
feca8e247dec925fb5a8a6daf207f81af8fd908905b2f4a5fcdb0243f55482dfb69526c547455ff70084ed5b5da3ebe691f35af1af7e7c9121fd6eed9bb755f5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-30_altform-unplated_contrast-black.png

Filesize
632B

MD5
9b83d3e977e41230a9e9a094e412f7bd

SHA1
116051a28db47ef22845804aba210688779bffd9

SHA256
c7965f12e0d493c4282994e07dbc051b26dd5d95fe390527f6506a5877e068b1

SHA512
ce2b7754fb3e6c33a1dd9186829da3b981d784bc08fc6fa383bd172e4275e88f81dc4a3897c3036b471bde6db4ef33766d65716ed8ecc18acd53978b55b1fc00

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-30_altform-unplated_contrast-white.png

Filesize
608B

MD5
193dd3ed9285ebbf0fb79a93228decbc

SHA1
f2475b74c9171be2ca0f47555941554ca13a58ff

SHA256
96519fbbba9029fc6214df166334808e86df8751f7405a0b8af812c870a56c96

SHA512
30aac97523d7b8ffc86bf58392843d730bef9b96a8828ace6be9217eb06a35320facb902c039b7f5209d5c11105a5991c45eeca144902ef20cb3f930bb84def3

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-32.png

Filesize
649B

MD5
c1a26f91bd23a6a6c865b1bca72912a8

SHA1
9178bedf3666d30adb8af404a211cd9735a13f9c

SHA256
0532b07e9decf2e53c44a17207a7c93b57e2285e6f65f349750bde4a4e6f72f4

SHA512
92302b24d68e6b5b1d88e23454b3434d98bf967c4079ef5a928fbe5bb25aa9f38fcd6f95ad5d667fb800a33c62a55207f7da83318a40cefb694006f13716f2cb

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-32_altform-unplated_contrast-black.png

Filesize
683B

MD5
189f28a3247afbf1b17ae9a9cc788874

SHA1
721206a8ad829d646a0c73d90dedfdf475022d2c

SHA256
5e4bef37189b940b417efdc91f0abf569edb8e067d5bac1864a1eb47a68946be

SHA512
96ffd4627f8f207d5121551d338320a939db3c568e2489277fadb6b6aa09197cc6aae80b1474c00e1779f5900324eb25b27035abe8df7c4044295f67743eb74a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-32_altform-unplated_contrast-white.png

Filesize
673B

MD5
f08f237ba9df76e5344f6d1dde7d7072

SHA1
d0e3c52453402fb40e9813b92bf5bce556cb13f5

SHA256
5ff9fba41b80869407e9df6799aab8a9d3ab86b086b93a0173f66f8faafe4689

SHA512
8613437ff8b8be50a8ba117d37e3172d650f8e953fa088c35e0012a8f26813bff33a98e8bb1f8be5bbcfcbfa7789b995a895b02f44595526ec916297be99f147

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-36.png

Filesize
749B

MD5
a5394ee13baefd246c0bf6060d38ec6a

SHA1
d4ab4e8de5564b0e20525a9baa0f8e0b5cb2a05d

SHA256
7d70ccd21823c7918de26edddf6b3a35773512b074225bc3b24b028d1a0596af

SHA512
c5a91ff923ca3821844dd2ab04bb472c336e6bfcb881fb955825e3d0f001361d31178d56a25ae979978b0175b2a61ab67b864bcff910d8b9225329b532ba2ad8

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-36_altform-unplated_contrast-black.png

Filesize
780B

MD5
b051e689507b22feec226d43423065a7

SHA1
da364c9e89b13f9a9178dce90ea944c5e9d6d817

SHA256
89fd40e83ff38d64fe6427cb74cc3ac5ac09de46536a74a2df0208909094740d

SHA512
d9a453081e125fb0905d33520ca0e92e2c5499bce4744fbc82c6a5ff559a788ef50e0b0f08f7b532e582f0ebfcc67558fda50be3e230bec81e599387e2962e51

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-36_altform-unplated_contrast-white.png

Filesize
757B

MD5
919c6a3342aa9825a42dc1bd2b5ea9b3

SHA1
abf02acab448481a41cacaa6a8b151a0ffc33f6d

SHA256
82b4667bdb04975842375cdb2d3adea035166366e6dad08a3d5c5e4e884ef87b

SHA512
72239cfdd4d680be0ba4b91e48ec1e1c4b929212c462f6f3547d753753e55f4f82470cab5c490706e1feda50757bb2c02492834225d585faf0e960fa924337e8

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-40.png

Filesize
787B

MD5
68168f044f85ea9faf4ca6d3e570596e

SHA1
9d7fbb23beb1dd424f2ff5a5f60ca7f3361fecab

SHA256
ba53865cc9bf60d1b21daa381bd3ae27b75c26fd45d8ff4393f88686bfcec2d1

SHA512
2365d5f565bb68e27d6a4c8dd89a23752335db4c5c51506e202c1d785562e72651c71deecff903ed83b5bf7281480aa86da6f90338cab0567153aa23da6b8341

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-40_altform-unplated_contrast-black.png

Filesize
824B

MD5
82c51668274bf0785a9a546a6e257bc0

SHA1
3e49dc4194de95aa4b28c210289710620fedc3e3

SHA256
dbe1f856324c36cb597cae985f4f1d65e12d63a9435a43457207caa7712d9d2f

SHA512
61e49ed0dcaf8adb1e014047e499977cfcfd238b0b98cff9cf177afe30d6500b6070ebdec9eb485b25db9d08ce123f7efebb4bf405790ad665a898cf44bc85f9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-40_altform-unplated_contrast-white.png

Filesize
761B

MD5
856d9b6612bfe8459d498de81a7ecf6f

SHA1
f483bb191ad1672102be0907c54d3a168db81426

SHA256
b665198e59b16b6a095f65a01d1e2d6247b6c9694dadc3ec4c2a95986538aa9c

SHA512
fd28d57102e5a93151ee66a4226e8a69f365177d58417d8c39a6600a40181f5d547a5228521c9e5d25abdd57790a311b920fd9d8d3f7d366fa8c76ededde55b6

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-48.png

Filesize
868B

MD5
dfbfe6972b7e6bb875970fe4dbad66db

SHA1
f1594ed9bdbc5c2459a2af984275392d9077e7c5

SHA256
6fe5eb7d05d520584f2158e8669264977a437f7daf75b7994f13aedfd2381539

SHA512
dd8a9aacbb50380a4d9b9049c82500471601a9897e26e2e4cafa28f2ec556bdefd8e61bf976569b46da9368cd8c183d56a8d0b68ec7d20b02fca0d48d91b789f

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-48_altform-unplated_contrast-black.png

Filesize
969B

MD5
2d4e69bf887108188e1b6409d6cc6d28

SHA1
6031820b4c718bbc491bb45f10cf5d850b4192a4

SHA256
b91fdbc9c46552c90c0ca41ee8fcd543f383dd6f50bc15f04e6b25e8fa29f4b1

SHA512
1680597b3742037e868c1cbaa0840f808a20a84da324bf562b988eb1dcff1bfe0062aaba91f9415f39229850e849b08263916fec6700fe7f88e2018a8277e3e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-48_altform-unplated_contrast-white.png

Filesize
879B

MD5
b5f8ede4d336a3c1e2d5e4eade79f7df

SHA1
ca95bfcfb47d1565912bc174c7958de0c1a31571

SHA256
abba9fbb0af323e7c41bcc85a771950101f4442706f1d1fd8f0c1c5c64d2fc11

SHA512
fb1eba806ab29ade63ee9eb1caa18e518364df4298377e7633c4a0dd5833238e6dcc6f1e4a72ae94f8a84420a3c4fd404b23154f901eba34b30a135ab25c263d

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-60.png

Filesize
918B

MD5
927bd7b732e69a2d7643613797504edc

SHA1
c1ce251e91479d27c6b63452e13aacd3a1af1e60

SHA256
bc4c7c205e546bce49c87f7c61791ddcca6ee4de5eb99ce50a578bdab146f138

SHA512
96b9f3d04206a5f6101ab9c41ec784463ce071d4639d5eddcae38a213feb0082df6356c6a1c433ac3bb237dc47e5a9efe7af01e60acc1034691799858a00f5d6

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-60_altform-unplated_contrast-black.png

Filesize
1001B

MD5
c64c679151797c7cec14d20826941b23

SHA1
d514236b750eb2ab35200696c26e677c614331db

SHA256
85e92f78430d788acd376c9213a70aefc2ec15df1cd0b3188e28cb4f5f0979b6

SHA512
7625d4d96387daf4d9ca34b883c7e6b8bc5e69a091668799494850e5495a42bf26c4e84b4162cd98b1797ad3da617fff4b98dd93caee93986fdb026b998da750

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-60_altform-unplated_contrast-white.png

Filesize
939B

MD5
de6e9dcc0f9602e11e72de142ce9301b

SHA1
6ef7b6ef1e515ec535ed7d103c7d1cefdc39e85e

SHA256
470869b40f07e488c5150036e97170c544013b27e7256bf80846f085da3a8ab6

SHA512
9e0201792791d92b1b1f6dd60c74dddaddbca74ecac4af8eb58a026f3347434c1a23d17d43d7a7ff2fcdd5cb63878ad224a3218de8719933394513b85161fad0

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-64.png

Filesize
1KB

MD5
24b4e008c6baad1294e1d8790d878d14

SHA1
5c07780175e1b6273dfd0b48c93700b4a7d9bf48

SHA256
c290188a41172f8158c0f975e744b7400592fdab11e119a4093539ad83270586

SHA512
ff6675989dbea879217b736407dc117232574a8ded2d350d57d9a01b81a75f0e46f876a55f252437faaa586313b50a345269dd7bd62263e037d67a8db2059547

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-64_altform-unplated_contrast-black.png

Filesize
1KB

MD5
c00560d1004df880d2eb6bd21bbaa4f4

SHA1
f8127b702e4f68293ec28f9dbeb44ad0505a1d4a

SHA256
10e278df172c7444c8cc1c3b199d353e4fcaea2f03ea1807ae1ba20970d9e3f7

SHA512
4dcd94b21f7645a566e029a67c65a36430d44cce9d9fe91aeda9d865c8d45025afc523edcf3f609904f542b5f33b54ece0129230e9279998d7511fbb34ac9b3b

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-64_altform-unplated_contrast-white.png

Filesize
1KB

MD5
3d43b758d4dd1ce79fa92f4a698f746e

SHA1
809f9ac50b247b3e8f35eee63a2e24bfafeb81c0

SHA256
ed5a2cc70db8bb0b07f67565d2a2a4a33e5102102f39aaf6a0d3bab2621a9391

SHA512
0abb9cae2ec6c4f793ba1bd3307d4565650cfb5a86a7d06a9934a71d31df87d21e6335e742cd06555fcdc77afe420c0784e60e8dc61892330fd7e924415e614a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-72.png

Filesize
1KB

MD5
4b346abab3232c47018299359809e6d6

SHA1
fb5f589c86b9c972d5c9efbc04e0d872580b0a78

SHA256
239b121a9a36aa687205c73d3899b130e5ed12d75c2030fdc654765eb890faac

SHA512
265b64f380c4813a903842fb9424a5e16f9f27b84b9884701e748e378002677685288ee0c2900c8deb8049b7c4f6b1cfaceb07fe0d12953168d43c7b241a7053

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-72_altform-unplated_contrast-black.png

Filesize
1KB

MD5
f15310347945945998a85b0fe5c9670a

SHA1
57e3f5379db970366d588bfc3069ccdfb38b3e4c

SHA256
e47eb78010e8a7a79781def9442f5addfc3b0fbede2a721084a4b7f2e8810e47

SHA512
bb4b42ac77ceffd16f0e6d55f2b4ecbed2b5eb32b18221d2d2e868e730b76a12f6baabbc59b206bd527b7ad8afe020f4524afd292913e29b2315548adc60012a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-72_altform-unplated_contrast-white.png

Filesize
1KB

MD5
7647225793f5170319924bdc50183754

SHA1
d908065adf3c5a96d59990f46b65032d285ccb08

SHA256
4bb3259d2836a8f904f5703c42e3c7db4924ff3bedc8847b45d2828b43e5c8ed

SHA512
f71db03541fb579765a454af7bf71b5ddf138fd63e97eb99c1151cad66beb746bc4ec98e71d77fe346c76b754489cd7d7aa75ae6459505c2cd94b90c483e4afe

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-80.png

Filesize
1KB

MD5
1b0c87801219f54d1c75d37af3b9ecca

SHA1
9336dc30097f1833fb152f79179ab9321bd42ee4

SHA256
a972691debb27d28217e363c2a02023907c4ee51fdd58fcf0c60d64b856e7e31

SHA512
1cd9377b2e63cc6836de1cc8e628a0ea6eb150adcde489446442c8c9e5347c9dd105eccfef3346a12ee6bd5a5b8ca44d0a0ad4a1a97c0e086909428aafcfb705

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-80_altform-unplated_contrast-black.png

Filesize
1KB

MD5
ff0aa94fe7faaf13a53278adc2698c32

SHA1
8c61b01052f520362bff5fa648a60fadee65ff21

SHA256
6684bf37a8dc1b5424e756c33b3f90bb881181dfd85d57470eb3c18fcef5e656

SHA512
140a141485a0e143227802ea2b24dd3dfc03486e2539cc67e9315f0c761850abb525c6b2d7a41cbdd56063dd11afa06f6562deedd17d8d2b9cc729d91a4a82b7

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-80_altform-unplated_contrast-white.png

Filesize
1KB

MD5
7db0293e6fcc87abc9a0945aff79dfe3

SHA1
49809dcf23a37c30787d261feadc8d73888d99ba

SHA256
cdc8afbdfc96aa91d1e3df6ee6223e23b041fab55429ca375d4c528ff23babf7

SHA512
741896be2d34887c913365534f0dfb5c0e0354a4d282c2ce1521524e305c4903711022f2595d4d3026901c85736431de9b50b07ff6268ec25b8e01635f25653d

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-96.png

Filesize
1KB

MD5
47861a490c54e0a983b98f53dacac06a

SHA1
d904739cf33ff959362b771445bcf404c730a4ca

SHA256
122e0ada5316373920063713ec84087e6769b2280e75858af9ec6586daf72cd6

SHA512
6cb6f04a7310222a2fc9eb69bbaa1d67601628a684e69c14a5d20a859edfd5e17ffdaaa02bde09fe78c0557065d0b24fd7c555cef7a065f5dbeda83820a9e5fc

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-96_altform-unplated_contrast-black.png

Filesize
1KB

MD5
9d782eafeb535514b02ff0ee296e8f1b

SHA1
86960bc19ca4c65302facd570799662a12fe2b12

SHA256
7c40b6cfcd8bcbb201a2edf811022a37ca47b73e85ec5785996477adcd0eaace

SHA512
af627d93fd037ff7262f6442c27208ac102cf36677edca6363dd56f9c2c554041600a55f3b877bf26be343d8ee980021a77682239715d7f6a9fcb2f97146a53a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\logo.targetsize-96_altform-unplated_contrast-white.png

Filesize
1KB

MD5
ed52cd09bf929b70c0ae9fd2007b20bf

SHA1
faa7a71ee9b105e462688b56e0f2d226223400fd

SHA256
b644ea2d909241dbfdcc7caed90d4a8d9cae526939832ea5312161e60fc24bd5

SHA512
2d7b89d1930f1eb54fd2eae71314e414c24489b9bdbb89b0feba5bcf2d4b8068659d1b46914426d62f4165b956738154f5edc7aa6f3c9e98ec7feb2e6b4ea16c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\paper.png

Filesize
2KB

MD5
835ee4c0ffcb4089f74af88812149261

SHA1
8fb1bdbb8fbee5ea46dc24621b1d199b416209d3

SHA256
3d11454bfbde59784ddd1ea185bd250d82ea02b31290e8ca7ffd3cf7467bb83b

SHA512
7786a362b1508ea34ee21bea8be3175cf4345bf41c1b5c053e28a37cdf46fd12dd21b48194ccb1c98d98d38fc9d98b215cabe75164417098f410d79a1e8a099f

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\papert.png

Filesize
2KB

MD5
beee74c21e7e8e508609c7d0a1391970

SHA1
420d9a0442c61a773907ed4457a18d7a6070b769

SHA256
d14d32557b917bc18f36a96157b8530b5cbe03bb34430c61229acd20ced24274

SHA512
5ab71f5c69bb55a12dbfb9b85a09819654263f818bee0f37a058a8a0ed98b368693cc8011d874f16ea64addef1cf35179738ea919cd0fdf202ec02bbbb95f9f5

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\passwords.png

Filesize
5KB

MD5
3f6bef094242aad215be2433c7529a63

SHA1
e5c08b505035752086e0bfd070bca097129816de

SHA256
bd15f021e8ba0f65ed8acb83b75c144318cd07908fb1821368ec2e43731e20f7

SHA512
870e5a196e05e8ccfc694603166999ad06c3d4ebcb5f3dfea257e0faf0f0d8d19f62b49e8ba2de228c342143d1b17af68ce188eefc1347291f35a691be18607f

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\vault.png

Filesize
5KB

MD5
ab976468233536a3f1cf99fe221ae256

SHA1
4d665976e0e75061cff465bec1108c6bf24b06fe

SHA256
051675975d3c1d1c2f9405fd714d0ff632da85b6515cfde7efd4586b32885fa4

SHA512
c80cfef453def63d92fa480025c7c0bf883096ec4b5c31943a4e07b00d5804780877f96035b3eeb0132dfdedf899fa39e7cb5ef63c1674f5d69b4984e0111f69

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\Assets\web.png

Filesize
2KB

MD5
e623b18c05cef08bb6e03156ce692873

SHA1
9cb00fb89329c12787b9a5592a8ce99494aed80c

SHA256
9871614ac39353ee111c07526131c473d10a556c5a91e9594f5a4c340078e1e4

SHA512
01d08c566dc34dc0a3642dc7a4363d8ea6cba02cd97d6ead502a7dcc9132770d42645fe1c5c427e8fcde6cef3cd6f2aff2d520931425bbf2b3cd9d5cfc585e4d

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\driver_amd64\dbx-canary.sys

Filesize
46KB

MD5
13deed6a11f54fdb082fac9906b9866d

SHA1
3335bc66dded29afd8c7a688665833f23c856e69

SHA256
4269061949da67e35b2df4c13afdcc7bf7406366d199ac25d7a70393b2af9b5c

SHA512
0094dc055e332b758e5badeb7d568195189543c5e689e28c5a673e921cb0d662ab973215e3df24129c000d0b100130f12ca52b91d8791c748667332078d63dcf

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\dropboxstatus-idle.png

Filesize
219B

MD5
d35744dd6ad8ac0704116feeb84b2b0a

SHA1
95ff79936c2712d5f7b7713eb250b1aaca1708c3

SHA256
a098e050f067bd14de41d0c3773b348b43621130b17340249dc331f441fe385a

SHA512
ee50e2bb0ac2f83e665bcc70e19893dbbe76cd9bbd036a2c34c39f62151f6a33fbc89838d755e5fcfca6037033efce29d4d2cb6cc1ae10206479cf494452c646

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
292B

MD5
739525d5dd75193d275ccb571e59f1fc

SHA1
2992ff963956e6af22b7576e43afc674d88537da

SHA256
8ea78c2b2f5f50640ee0cdbcbf32ff61c95d1cca383e2858419edb9482c2cb3e

SHA512
1959f6293f7347b4da5b43a85f3479c03f50cb0d5af4a331b4732cdb643d4cec70289cc5158621bfabff2915193266f214d47cfb51220e5dafd4d6427e77e318

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
347B

MD5
91ffaacb1fe0737e0e67141caeb3c8de

SHA1
c5d093cf65235c92eaed5160eb4f3c4ad3a362bb

SHA256
640148ecad930799f19273e6e703689a32be19dc900172f899f6831e551d605d

SHA512
f2f257a557bd6bfd46d6d8158c2b674b8611ce9f5e959fc9891e4f030869537e57d1aa0c01cf3b2250526247c7a37b9feed45e227b38825979aa76e92d05d494

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
497B

MD5
d1984b5d3a0fc6ad3c2aee784ed800d5

SHA1
2b50e75319f33c1f8d38a6eec4516cac9d063832

SHA256
e21391160f1142cc12eba0cc667f2fbff2f0905b82855385ed9f0c79b3413ef6

SHA512
79181ad7d41d281575501c8ac02c3edd1fb1e6b2b0cb32747492c8b81c762174e1bfef02e8219ed0e43109b121a19f9590b7646aa66adb4d41ad6cad9da0768c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
500B

MD5
de1650d0067103210e0cfcef396265c5

SHA1
bfc60df6b11c260fe7f182642970c25c535fe8ef

SHA256
246541e42d74e337bf93492da61e244d15a724cb77e12d4ae6ac81c5e3b76827

SHA512
a4d3c5a53025bad607329f6c91f61ec8816872e581b2edffbeb71cf02a71f09f678ed145baa75bf2513cf72bbe6e35aaad08078ab171c2273068cdb6e4d8556f

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
339B

MD5
23c649977a5fee0ec876582bf89ae8dc

SHA1
e15abed432ab9b9687045f4d36bf3c63a66c150f

SHA256
7322a0ed70b4ee98b15da5c7ac30082580bffc0c6b4ebee9722f049f39c511ad

SHA512
10888038c5d85c112bf126a00f0dfd5254b4b21d4abf480194ec9770be816bc83607d2cda33bd5892df0624b21641ffd3c2935f34b636d55dc6666fcc3e6eb20

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\dark\[email protected]

Filesize
444B

MD5
6987d9f94f2dc1693540543e43f5b630

SHA1
9f114dda8eb2528c2a2269fb6e35771d44746261

SHA256
e5c20664f6c1c24477af32a1f69420c4f5b5ec96e4c3426ca232101d2bdf807c

SHA512
2e4b8aec4fc7eb5e6b6fdd5386844a4920cebb73f4ee0bbf39d5a0212c18d93f6873667d35926fe88ab4677093c47ef66646ad01f245c1f1f2cbf4300440d011

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\dropboxstatus-idle.png

Filesize
484B

MD5
644eb1ac4b4b9d254c1a5d6ec82ffbc5

SHA1
25e1f939e72fc163457d636f653ae56b09f84303

SHA256
bbaeba414da07b9a42d7e16f581dffc4dc2b0553dde5d0a799271c0b4b41b67d

SHA512
50a15e01e94a82b43986ed5fd5a1825053c0820cd7dc3f66737f8746ebadeb388f33be111596f4464cdb540af4ff06b278966b283e40616ae8f65bae4d4b3351

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]

Filesize
640B

MD5
4d59de08d6bbb92e704fceba9a0b27ae

SHA1
2c57d34839086d4e4fea47eccf0a9dc22765aefe

SHA256
a759f2b68a2bb7ad75c8460fd44cf27f77d9447b4efcd65c7a62cfd27f575a17

SHA512
fc0150da5dcecb96eee232d0400b131a655c9f4537e8caa4377883a9fb0b5d67fc3c9dc2fbfe4cf54ece6c3bcfb7dcb1caab8322da90ffa1a4ac84a498d1689c

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]

Filesize
718B

MD5
c06606550868e1b089ca909fdfccc0c4

SHA1
05229956b56cab612455004b5f469ede8760e0b4

SHA256
777e430dac2785081a899329d2a76a64a174ef57683315ab4c80d3a13a3cd19e

SHA512
92cc1028de4c30f3662ae8b5d7e48869aeea77a492a439bfc29786926c54dee6921ca21f74600fd8f3018b2b166135f7bf074f65520b9244eea4219d420385b1

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]

Filesize
940B

MD5
1d75093fb52cda21b8610cd20d07789b

SHA1
6c929aafdce92f4bd3fde42be204c02028dcccde

SHA256
42760b6c8ad45cd02f3f7276e721e5a623d720fdb0af8c8ce330f5cc0d949de7

SHA512
773f27e96237265f20b670e99b35a4007425e3f2382f676ac348e44bf6dfed1f0567444e92db4447184482ac54e72d25a314520ef9ec437d4c6fd15270cb76fd

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]

Filesize
1KB

MD5
db1ede69b700d325fdb6a7e65338c8dc

SHA1
d1516db248b58773f77623be1de8b6206a7e9cbc

SHA256
87b95507e1395c363e814644723305aedb62bd989631e51a7dce03d36f820fc1

SHA512
77b3cf71bff9fd1636729c23a2a8098b18475e1cd9b0fba360580118e94054b7c268283c6f9f499a00cf7ff6cd788511f211061e0fca31d8a1abbab9079b89ab

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\legacy\[email protected]

Filesize
2KB

MD5
c821cf48689bcfe5cf1c4a6b37eb2ec2

SHA1
73d2261037078785d4fb5f3ad5b3d222b5a871bb

SHA256
88f5ad501b3eda190391e39852edfcaa62ccda155d97ac9906f5c24590b984a3

SHA512
1ae2b2643be148046759354d97004ae761e27231cece903179d583fcadcae865a76e040bcfe3e90dc7e9a2bc810ca06a0f2aae68aa2d26480a155527a42bc351

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\dropboxstatus-idle.png

Filesize
217B

MD5
90dc2f1449cc1d87313dc13f2bb7c7ff

SHA1
7820e2190dd088a2f100da14f465239f9ee2b7f7

SHA256
981b9ff92e28c83e9e3b43e45bf51b1a2f7dd2242837681f4a71784d9a60057d

SHA512
34f27affae4e48171b21ae373aa71c9bbfeb2b33006cba8d531ff845a8647a5f375cfd2c556e08dc8f87b87fb504da429a6686537237c5eb13f053fc8a9b291a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
278B

MD5
aa353862800a3249f786c21e6369adaa

SHA1
df3ceac047e78c849a3ecfaacc680b389c3d9ff6

SHA256
fd5df7a65010498b37a02a14b9604410bafc98d546957cfdefa3e1b9a761882c

SHA512
7d478c5c587281ffd286b04a0b6b7ff39c552f5b429cd2ba4d332f497e3819ec49c01e03fd459af27f806c677b0e0005a4fe93c9d8bb295818dfdda772163f0a

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
341B

MD5
dad78ca19f19c2b578e3c700c0aacc04

SHA1
5a3817de31c7d7d88e5c63a6e22f675b1935f4d5

SHA256
8e37becbb06509835ae09ef704b6c62208ecd6e80f280d47d68799207e086e65

SHA512
1065218f5f6a1b1719b06a797b15ed8c84825fbf0d9f87294920d9c4affa3fb27236861d87e68859abfe698c140df78a2b11aa611cf914d9369e4300aceaeba8

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
436B

MD5
032f6ba2afb9f925e97f4e815d6b6b01

SHA1
278fc1fa6088200fd8711882d127f7f7cc10ecc0

SHA256
915f1777e60d5ad2b9546ad03f34157b70f3d8ad1607e5b87c111be4692b054c

SHA512
e77815dc3cef8e64bfed4577023599b683c9e9136d3ad1a2b7957698aad00e118fb5b0e98449068777f76e8ab8c60bc74fdfe103b555ed104437c805c83730c1

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
487B

MD5
1636354d176ce21aacace627b85a8e4c

SHA1
65607bbc297dacc2619bb60d2fd7fd08822dc155

SHA256
c64ddc1326f394a08eab8f98ab502dd648f0b269d9807ed7e64ff6ee4d9e201c

SHA512
b5fbc29861bd970c05c8c05ab30092d40355c314b4edb8f9df95f1a3c348127ca62a43759edcffc55a400617f790823cb51f10f6d87bd9ca8d47a5d2b87ea0dc

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
326B

MD5
4c6de1dcf063b8dd65ddec5831e7877a

SHA1
a092a3aa8f802191cc9c9e04daff654ed748116c

SHA256
5236c151f310555761abab2296c2130cfc9d3af072c9e88917227350f69225c6

SHA512
e51f5d8fdfe799ed956454f3f52eacfe622eef8702cad0fa908754d43e60e0a83a1073dc7cc0755c259c4d2d24e75688519d8941c353e2fe2bea6b43ecdfbb72

Download Submit
C:\Program Files (x86)\Dropbox\Client\192.4.4605\images\03_Tray_Icon\win\light\[email protected]

Filesize
423B

MD5
41b7ea9ae6461f316663b4ec1fab0e2b

SHA1
39a515a1b208b505c0d7291b700966dc878869a3

SHA256
4f2be4041a2866d83856af99185c920353a3e6bd7c3a4b19da52673d5cae515c

SHA512
6ad83746ae1ee43ae46f448f88b74793a781110e9b27a6019a5e5582d1e57d89b9a3b44108e2b0bf02b8a900413c56f6592ef983980c056b06e1d321b4320d4b

Download Submit
C:\Program Files (x86)\Dropbox\Client\Dropbox.VisualElementsManifest.xml

Filesize
396B

MD5
01ac60b4f6d2bcc67f7062aceef30909

SHA1
ed7c919b3b55aee618be64e84982ff37bb30c582

SHA256
ee823dc801994cf296410525a70c8477b01dd4182c4c1c38e863f26797673945

SHA512
82ff949e7f6676cc82598269410748d7a267e84e446735cfadd460f6d67f4e5e923b27ed310e247b2b3a460152aff9e8d911d956bd083857e116d5ef1a138073

Download Submit
C:\Program Files (x86)\Dropbox\Client\DropboxUninstaller.exe

Filesize
223KB

MD5
1aee0ea8d05aba844c701e23383f617e

SHA1
5fb2a76b3db4ef22fce839b0edf3c3e90b3b83ee

SHA256
81128e0e2a6c5b9c4f92bb9e47e9316453e88d6b4fde39976de7887570aa87e6

SHA512
b13c18ce26ad81d29e0c30724911b9f5dd3aed786853bacce7c0fd9678367f04dd81051d6ab58bfaab0b6e24587dfbb1a324ebf46dd7a3e6c554360d43c8a83b

Download Submit
C:\Program Files (x86)\Dropbox\Client\PackageAssets\Dropbox.msix

Filesize
62KB

MD5
939c2f4b3a4210542e5e59479398fbcf

SHA1
cfa41e9f0e40911a55ca26a63f81f593bab680d7

SHA256
c924be5858cf05b206227b825e131c0c99801b84b1f12e3370bfa6b507788e07

SHA512
ce593144e025fb01ba6c8ece6533c7361b71eeeb6a8ec2c80034775c1cd43ab800352e4a4b943af7f9ed119f3c9273539003ec79ff64f7760934ff67452af56a

Download Submit
C:\Program Files (x86)\Dropbox\Client\PackageAssets\DropboxExt.69.0.dll

Filesize
552KB

MD5
70e8c11c9689223b544361dc407b3528

SHA1
a66058f05539ead1f215c247ff3035d0437ca27b

SHA256
a1037eab456a0c1e105aba87252d29fa6676a6cb4ea3e01df0f479114ec564b2

SHA512
a11850b9aafc839e8eb8f0a334a22a7ced2689bfe0321db7d7feaa61aa66cce2e39c3df361f34c862139015cbe77c479895eeb5cb92ba8f18aeb6370583bfe9c

Download Submit
C:\Program Files (x86)\Dropbox\Client\PackageAssets\DropboxExt64.69.0.dll

Filesize
596KB

MD5
358b47adac253a76a0eb73b397a3fd8c

SHA1
b3abc21c441eea4866a824372187dba23f6f801d

SHA256
fcf2d15f7e5fa9ff72cf5ce494bf5476f1014e2b405e4cae0135cded0fe23674

SHA512
c1f4d676e18b5349a35dc835380e654a1d07a97508ea8d10129de4ce70fe26f591c801dfda3cd26a0ca57d7979c5edd033cd0fc3305c4c059f64b251bb2857b6

Download Submit
C:\Program Files (x86)\Dropbox\Client\PackageAssets\resources.pri

Filesize
19KB

MD5
9b9415015ee44fa15fa9a97ba18e1643

SHA1
348534f324ff535d299172d358373036ea6cf06e

SHA256
c0ccd00394ddd0ed60e81ee36e5035fd7823bcdcda9a353fd2ecc6d2550f85be

SHA512
f66116ad6030c999c2ed953f9222dc51b4b82ae9d46063b367c6ff21aa568058d0617d5ba92952c9130aa52a2260c1b32dec2f0d65713ff724460dd3bf76082c

Download Submit
C:\Program Files (x86)\Dropbox\Client\newDropbox.exe

Filesize
11.0MB

MD5
b1b81a654f93a150a4771abde9fb481d

SHA1
22445c3b2ff421793eab57742ebfdcf8a552284d

SHA256
938c3383bd843becfb0e62c15c56c56d258b5849be7dc0165c48beeead474b2d

SHA512
cb2dd538b46ed29b0152feae60639d4c92be98eed2cd9988d8e0550ab913bdfbf4997b95d1e7707b0894373333dab2a324495603a7bb51a256f3d782101073e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\qt.conf

Filesize
87B

MD5
50d926f3ab4e801c74761a55175ccc68

SHA1
2850d839dc4a1c3783f434dbc20378d95a6a37fb

SHA256
37dae7aeba4162ee7a2288123a9468c2faedd780c5f95dca2f1d1b6ba1abf0c3

SHA512
a8d2eacf352040043e913c9934fdb71b2ee92f809b9b43d98d1b2afbcb80da738e2f655e9d225d34eb8a585708e017a1439b3b39c9a4d0926d04c37c9351c37a

Download Submit
C:\Program Files (x86)\Dropbox\Client\resources.pri

Filesize
133KB

MD5
99739c3fbcecd7d005426062973945b7

SHA1
59a975c32ce0ee302f0f1ad7944c445c0b4a0b58

SHA256
302a326d07ed21c73f2f767425d8c2adecf039c0354287ce412a22ccae2b8b4f

SHA512
c916c9f0288cc8e0929d76be9a6e6a11307904ed99c3bc2d9c526f3308e51cf71885cc1bd35cbfcd89cf9205569c8f0cea1be8197b36f21989d069a4cd760585

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\Strings\language-es-ES\Resources.resw

Filesize
7KB

MD5
fed758a433fae9f6bd6461b769845d55

SHA1
89f1efcb9a9d568af64b109b72ed6ab77803f15e

SHA256
75997383b6597a725ecdc87f688ef632e218bb627bb724c347416937deab768f

SHA512
a04a35ca6129feea3987e261d24fbd4b2419511119ebce5c7f3d34d369eee122ecd16cad395a73812f255498ede9782d8eaec4fa7e966e340353b35600ca0977

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\VCRUNTIME140.dll

Filesize
96KB

MD5
a4cf5c1f71c540c69371c861abe57726

SHA1
f272b34182db8a78ffc71755b46a57a253fcd384

SHA256
c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574

SHA512
f2b53f28a6369f76b22e99fddfb86730f3d33e87c68dae7aa3d05808223693bb86ade263cccb99d5462cf98eeeaa6a6f1cfe5ea3aa1739f8ad6eb624caff1045

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\dropbox_core.dll

Filesize
11.2MB

MD5
23f914667af29bf7e61110cc9ee3e3d1

SHA1
83aaa911e2cfc2f915e064d2a7555e63d24c00dc

SHA256
6ed1619ceb69a41957ace61dadf47fd308a13831b86aad9198af0caf82ec19f0

SHA512
d32545b7b7602364d615121eb162a4598470afce7d84362843b6945b153a70c20e0ad6b0c086e7952a12f38690ec106883853feb72416453b5f7ebc83a626526

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\dropbox_core.dll

Filesize
25.5MB

MD5
b9c993ecb09f6d37715cfd4659f03b32

SHA1
0dbfc11ccd47bd7797799e24e22e5ef52d367600

SHA256
978c81c44c50f4c34e1928324becce9045c8a5c10e744a4ea9e9b2166c63acbb

SHA512
1bcfb13567f648c5b87707b4bbc07e8072a3b30995b71416e17cecbc562285f1cbb25e0b5e71db8ae0e68b0b7ebbd33a712412f5e786c62baef99a1f6b018cbd

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\192.4.4605\python38.dll

Filesize
11.0MB

MD5
396da3b5773d18ec968b4ce0a3a870b9

SHA1
a1e358d5a03d056122ff715938732c034c568b5d

SHA256
98143e555e56c20729d7149b8f285bc967084348893c2ea1909158223fa017e1

SHA512
f7cb07ae6a3a725cb345016c81ff1e326571477098d85b0d84c883071606645b472acc38f8e11ffcd3360e79cf6cdf0b5800d9e00f43684308ae1be6950148a3

Download Submit
C:\Program Files (x86)\Dropbox\Client_192.4.4605\Dropbox.exe

Filesize
10.3MB

MD5
35977b93160906c6617c472395af02f2

SHA1
e6a9f45267cf5b66a252b96e619d3a0e05d4973c

SHA256
31367102685742e8291c6ff46351866f4f3b018cdd1c979b27257ae9df79d220

SHA512
5295f2ccec0417866098beaedbfe6f8416cc126aa22f3aae4fe9aebd27ffbc9caab4e0095bf6b22ef109330487902332de43ad2d2ebc832c7153cf6fc953aab6

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\@PaxHeader

Filesize
28B

MD5
3085c4380ddd5202b8c4d2d3d7febf2d

SHA1
d9aeba7873714fe502bae2ef944ad19d69b88577

SHA256
412b73af831d3191f647ae7abdaa8fabeafeed1bf4a1cb5707308fdb2d7a8693

SHA512
5a3d68c9992886bd0e576e4e31869e9c2e98f545466f937cf01fe640c4aaca7f66cd695dbed8ca3180ac87c281830255e5c6787c83f37c9e1ba0e51aeb63a2c3

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxCleanup.exe

Filesize
299KB

MD5
8fa7f9a62ea19f3691e8a24833a5bc25

SHA1
23f0825ce2f4731cc73e82ca814872b512d333dd

SHA256
0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72

SHA512
3d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxCrashHandler.exe

Filesize
129KB

MD5
e3214461da70a51d0fe6ab76dcc753c1

SHA1
5ce885de14919fd7ba6ce35726480b098eaf5acc

SHA256
2e3925b6c2175a98024551fea9e0b8dbc54f4107322c97b1493add40ed8ab73b

SHA512
67668b4ce7102480a0f37113922c9197ebe90619a2cded3a484024902f167bc005fe11f50e3d9509e2d4a4cbad1865f61b20189ddf37e916ff01bbf38e9e2aa6

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdate.exe

Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdateBroker.exe

Filesize
75KB

MD5
2677fb41f870e8a05cd60d4b7861e300

SHA1
b5275ca2df2865b96fc359757564febb44f34278

SHA256
4988fdaeb6a33a3169a9ea445f5bc00b7bdacb78f7ed6a98b2ad2eb73b551ff2

SHA512
d4aae16b4ba3b0b6b247fa29ca5baaf322ff0f6d941596f6ff2bf5eb1184162e2a1802d97f3040bfac3ab162259c8e4115445d23dab459e65fbad5cdd06e5ed1

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdateHelper.msi

Filesize
26KB

MD5
ad80274ebc288f8bcbfd7bf1e6b784a2

SHA1
7bfa68f1fa73986dd9c13ee719a2c0bc9bc2b9e8

SHA256
0772c75f19a0e35b3b02831563a72897d68fc7eb2b304f2d7cc58eca0a00cfe5

SHA512
d6a37fc7da74544d672ba98f07dbe2f521216ac1b383209d943ee0d8ff9aa9a66aa8bfe933a0df5baad7740ad913b559f89cb57de44acf5d4cfcc11f3bd177af

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\DropboxUpdateOnDemand.exe

Filesize
75KB

MD5
7d0be196d264cf662aa2edfff9fbde8c

SHA1
58820a86a093b91ba563402d1e9be233c19de9de

SHA256
70272968ff5e1c47883ecb74680cf3a298af7b87ccacb932a57a0198ed69a65e

SHA512
78f1621513b5404c53a485258d9a027ba619ca570bfb018e1a1f1eaca23ab4e79bd714c2cc3d1ab55ba0abb84c0af7b64d14bb7ac89225a5d2c817c75d1b9927

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdate.dll

Filesize
1.1MB

MD5
4afe69cbfdbf9914ec0c597f5bc5a1f9

SHA1
88e03e83a62e5fc37c94b26e6e5547b4ca7ead9d

SHA256
34b68127792f3c80c4a3e616c9c8cff8e53533518f80c4aac78f2aaa26e9615a

SHA512
1cc19966856b1495334d606ea8e9269f9203a6cb5d9dbb919c3485b0ff9e1941305af062e3a0e740afd2d2d6be8a4d50882c428c8058a2b1f8dbba4cd59f8fe9

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_de.dll

Filesize
35KB

MD5
8ec648743a036ef57ee419488b01387f

SHA1
afa9fca0cfb21cc1f05b31f1b55b1f47e18f0a88

SHA256
9373bfaac15573f63b42cbcd39e4ef15a06d6a27696541f1274a2aef25570e70

SHA512
a7af27890c0fe3f86bff9ae03734442a2c0b4d9315a5a6221531270caa8dd6e55e66659f6c1062d589a08a41a92dc4101f76430d528694b037de73b4407e4e5a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_en.dll

Filesize
31KB

MD5
fc198c77a954eb0eda8424eac724584f

SHA1
d1bdeb781372cd4907e519c2fd81094441385536

SHA256
67d5c3f8a6e9415deef22148a4216518a7ee52b468ba6bb1c67020d56d9e3745

SHA512
74572d8422a57046ccf5729eae36c396028b9162581dad80f20299fa11426bf453a7ba5a34022ec3103a7b995aa9e77f5dc44ba9de1570b03b964b38559306d6

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_es-419.dll

Filesize
33KB

MD5
07cf9b2367462de21cd1c1ee5ef076ae

SHA1
15676dfe46d54e7a609fea052010b847709535ee

SHA256
4d43704f744093b41f9d3315c508933a91c481732b84e0b14bf642aa5d03e020

SHA512
a96d4b80215adc19f7af295e863017bf895038ea1346222337842139d9e5de018f8706fbb251d4012db262bc608a9ae4ae21dca08df3a5621d7e00281a491942

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_es.dll

Filesize
33KB

MD5
0e13d60b08d0653ccad9cd22cf13ec85

SHA1
2ac7fef4c9be1efca0c68ce7bb4b623d2824994f

SHA256
7dc6bb82fb6133e879309b0200aec7ae7c6346deb05a53daf1803443db3c8cbb

SHA512
94909d3e43cb0a90c6fc595fb24c5a90df4f9574bbc4f447dd534e6114c14f6905bb07a758719fd45fd357f28575bdd3043335ac0dbfe498ff3c286654b9ce6a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_fr.dll

Filesize
34KB

MD5
ffdd38e5ae41822c584b092eefed9df0

SHA1
91da41c12fa3afcac80d0077c0b3fce918b5a4f2

SHA256
3f3ac9e29e480d1c6eb271a538bb966953c9464659d044cdccd8c99df7f703a1

SHA512
e06d12b1caf8c23496c7a75f7454443ba721691e245d183ec750e95b013423310e921587c0d95e5ecce1a816c8b538290f3018b098c788f0e14403fa3cce9a0c

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_it.dll

Filesize
33KB

MD5
cf26a8d0d58a87db417185922c761687

SHA1
e28c3c48594d5aef78966d0e210dd826c2f69a2d

SHA256
83c860a5942fd6b307c428869a1debb188fa4a8dc27d2ffe4abe0b8453254e7b

SHA512
fad6342c211b0597a9962c0bceb853e07f705f42baf92ac7a288fe5ea608c038923f509d9d77041eaecfa6f5f926138b524ee6cd4154526169eabb675c5ee9b9

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_ja.dll

Filesize
27KB

MD5
d22b960d1fa795eb7996d1be6a02aab2

SHA1
e526d5ce5719e1de891169305a367677f76e6e7a

SHA256
016567f8ee776cb57dfbc7e6a8908bef7004fd9abab4286800863c745c08e1c0

SHA512
40064f12538c55c2589bfa40ac8559aef71177ff7379e89c68ccb509c012a4295977eaf87e3a7be50c30e36d276b798217d7ce902240480f54f35fe44497d2ce

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_ko.dll

Filesize
27KB

MD5
19b6ce8683c1d7a6ed07b93966b5e415

SHA1
9ec79b491b4cc71fe6a3431ceb5fc26a217fed57

SHA256
4638e83c8e01e837078797f8ce2e4015a05aa7e6ee121dda107adc473f4c281b

SHA512
1fb52b00a2ed152a199357bff6fe4f994c7ba434bc3f3da960cf2a9ea52f41dae9cd3a0b840c87e25ff463077f1c32fc0f354fb24288c46a251e51b47f57ce80

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_nl.dll

Filesize
34KB

MD5
7d26147723dcf53d0d1b10f98f891d91

SHA1
501674d1e4d53d0d6b92875c65118f7f5ceccf66

SHA256
5f577d78457e5010c90b3614f94eb3b03f4f66c752191e25ce2b4f397d481ad9

SHA512
deefae29107edd6c240308b7e05680b1f9a8f2525fff29a6cc47742345a21f285c6285440c26a36555b97b1d73e8b16a712177f8fcef70aea6d5da0e35123f15

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_no.dll

Filesize
32KB

MD5
6bfb6b741d1eb83a8d1a96680bc6da51

SHA1
9263e45de354b17b9091b688ac63aa31796647e1

SHA256
8a1622e758b4cdcdcef80095f59c604ba878b1c853d66a338459b4de32ed5fdb

SHA512
d65093e4c85cfa22054c9c09113a36360b23214ccf7f6cdf84df0d4d8a905ffa6a20e8385fb3fcf78fb96d91ce49f29826c07ee81fc62507218b48ef6231a5ed

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_pl.dll

Filesize
33KB

MD5
1eadd3df335b90ee62a74966c1693af5

SHA1
21e5152b54f08317f13b6c97ffd67d4d42e76aae

SHA256
16ffbd7af2dc7d11199bd769ac3355efb39b4267f0758ef8d60ce4bdf927d394

SHA512
9b9776d5e0e47acc6234913faf2421da4c896abe84f7129a928393d5ccc491ff8a92b82ef3b76b493e620bc6942e3248bc364f8669ebe2444fe477ed37956e8c

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_pt-BR.dll

Filesize
32KB

MD5
2ea9dbc90cf842de5ac5cced84d83a8d

SHA1
2a63a275a4d4252d4e92a2e2d5827f1cc1789a4b

SHA256
b500301065031c6826991f0b0e712e2ac09c465f686b27e0aa5121a9d2bc2529

SHA512
57d50c6124273655e4cbd3c476882b7795e3d58c44121c5260bb9efcfed75fb708e622eb4e67dd4e1dfb3fa7e1b9680ae35a51248c8dc901c64c6fc708c46fa2

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_ru.dll

Filesize
33KB

MD5
ce5254b7aa5cc2482449b12995976bc0

SHA1
d8aba69d1b11eae587c1e5357e08f3c66acc1c1e

SHA256
8e5ddf0615b84665e5cb5b13a0d5f72167c82dc4a86cc49616ea445f6b801eaf

SHA512
5dc50fec4f9685f74d4638ed0e2f8e4c493ddc10af0416a1fc495782962d16b158bae71171338230bd17d91cc686c3e9b82febb006c634791560385328b3ed3a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_uk.dll

Filesize
32KB

MD5
17c6392aad88515222ffc54dad9a0f36

SHA1
9f0dad897f9648167b9f005b7e2ab86c6161e6d5

SHA256
cbd96676b5097470250dc8285c6523ed598ccb58a4990c78abba79d4e1a67e9e

SHA512
b5bd6ab5325e772347ab8de55ecaae8546b46bd9dc559c17c3b965b4627cfa25c406f4ca6bbe17f22e21678c80a3ec03260242f29b1beb817d78639e37a2f940

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_zh-CN.dll

Filesize
25KB

MD5
0a62f2c2d232d98a8438a3d449a520f3

SHA1
308fef4ccf6926977e5bc1064f554fab0d4ba36a

SHA256
084a88a2171690934370cc603c0d809ffb9f0e55aeaa4055f38af2239d0606e5

SHA512
db74ca3fce77ce1207041494c9b4d1e86c39e9e796e8e8a31ac53e6db187b4cdc70f3b330d77db0ec0b2282b76fe9da379e7065c042993fd9044e5c1c7dec13a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\goopdateres_zh-TW.dll

Filesize
25KB

MD5
dbd5fa781509ed7d863ca11877f2a28e

SHA1
1b52ae5bb49c06ec7c25b7675093846978dc6856

SHA256
2217e104660a21c2c9be0ad68846fbb4f7ee16510ece768f055d9e9cbbd60a9b

SHA512
7d9b04cbc040ed6c4df8e10fbafec70500c9fcfe228a86e8ccbec4945bf04ecca6a475e20f4cbd36e5a89c6847e6107496ee23e36db0d748104bb01af8985505

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\npDropboxUpdate3.dll

Filesize
273KB

MD5
52d461eb7ce99d0e6901eef682d83bb5

SHA1
c317560a11a91287dd31db5eeb2a1145f711c09d

SHA256
e07b2a1d2c932fc38d3fa6401ff0be653250a1e8173311a9312ef9478da28e2a

SHA512
429d18c1d8482469916627e32fd938f7d770b391e50f249b79bc7e0553f6b1633fdd0f0e54c069e23a22d8a174047c71dfbfc7740a026b414d56556accfd2bab

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM5275.tmp\psmachine.dll

Filesize
211KB

MD5
70663a8818622003e50b36bb392b880e

SHA1
23670b780d232e70a6cfa5b2d350992d43ef722a

SHA256
3582062df2b1120e6cbe47a4c5066b0f3e0959518ab572a62f2817e55bab6518

SHA512
0a62442874598ed8e7986a99dd9d9d4d07e987586454731feea6427fd9b2190d5d2fc502e2efade839d010ac7e11135daf0921275a911037284ebfbf8bd3c3e0

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_da.dll

Filesize
32KB

MD5
1ac5617cafffbb69ab768095c77b4306

SHA1
c120a49e4886f839fb96c84f87727dd023fcec19

SHA256
8fadf121a5766032bfddd0f6342dd6e2a612996370ed1f5c548f5cbb5ac548f9

SHA512
fd26156f9651f5237df3461128547496ab623c5a34c691f410177c3198608de8618a199f48f3a02155ed3fcb8d9717fd3c3cc8834013a99f1dffa4f3d8913ff0

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_id.dll

Filesize
31KB

MD5
5ea2ba9a437c4b6bfbb228356ea3be59

SHA1
19d27cf893537002313808a4e32581f344e4eaca

SHA256
e0d5ea9edec2692553371e4579a63d5dc7c554867f3f90ebec722d97d2af87b5

SHA512
fb78b0c4d7066922cfa7a234e6e2023042d3e2f25cc6a6be5eb26782d836bf30f090eb15be77b4c211e9c7fd8bc28b7e92e50cb7bb2a045412c74e8982049fcb

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ms.dll

Filesize
31KB

MD5
6922f23814bd549972b548acc4e6afce

SHA1
17a6e724904a09175b1c3ecf40e6929b89662585

SHA256
d7e3c82e12447a9aa4085317f65447607b75f62fa89edd38fb5621dbaad9211d

SHA512
f59d9e56e2a06fbd8853bccae6e69f6b51c07bc9c18c84e559d6e81bdec90c51c555676891d9a9c6233faedfacfd15941abd1c033710e14ba028cf82557109eb

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_sv.dll

Filesize
32KB

MD5
c8a5dea2d0343249eac44e0dc550b2dd

SHA1
681081760d2983f2025e21356397b5bc067c3501

SHA256
401263a24666710b8895e0d5fa5857f7d86c4ec21595573894e07517e94b52ff

SHA512
bfceea37a5e525738380ee9049daca1913da5603ead0057f5e8f54022961db1cdf0da370e1af8b841997f1e46514eb5f4e3c4492cba66c83d6eaba1a568fe05a

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_th.dll

Filesize
31KB

MD5
1881415301940deb7d45b120a39679c7

SHA1
3bcc72d91e9a1c35f5b52768c9a77a0faf2f16e0

SHA256
63e7af52e0f6e41c351d33ed4928647ab3abbca3c767de570891c3ada13d4e1e

SHA512
6f35a017af72df217eb3e511f57d8c4796cfd996f30308cedf7b44c16cff3d34fbf5745df00398c1232e7f685425a2269cd1d35184c6b2007afaefed25549188

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psuser.dll

Filesize
211KB

MD5
732dfd011b5e71f1f18229e93d8ae039

SHA1
6ff911e082622bb6ba0f43734a17de3963a29c43

SHA256
56ec8884c392f95202d07959414d256c737354ad3243971ef47e44a32f011aa5

SHA512
376df248b77a07df573b1fb3fe111d0ba4f9e91e4fbedfda24732159bb4eb359e3f6e91de13f6f698896a0a64a39c68b0a8d125efd588b5ece762daf985099fb

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe

Filesize
52.1MB

MD5
dd0e0c4121e6b7712e8cce4da274e9f3

SHA1
2f847d26859cd5aaecff615fb1f22f9542c522bc

SHA256
70f4759fb28a70ea6b4db85b908c76d73d01394c2dc58b769ccc15181efaf88a

SHA512
3cd543c6163ca0bea3f6c084718f796c68bd22bf26067da889310e091eb634a9f37ce608327f182eae55ac0a9b366d46d8899376022882d622eee0b636ffc59f

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe

Filesize
4.1MB

MD5
6e893d9c5dcda47ff57f479470e04c47

SHA1
579c8359d6a736482bcbcb3f24c681139cf5415b

SHA256
2c467205bb945cc3f84f3429f4825e11932b0808ddb1a2d7c4f602e5bc03b587

SHA512
d05aa42788e6ab8a40dd6c866d11c0cff5d0dd74f869e6a5abbc81bc489b20e2519979462b4ac9779affa5c8c7134b5760914c424e3156895645f9748ea2c92e

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{F124F5F9-11CD-412E-A2BD-8BE387D4A27D}\DropboxClient_192.4.4605.x64.exe

Filesize
6.2MB

MD5
487cbaaed9c15fad995c1ea3296badc8

SHA1
aed0d75041c63f3d56d5891a87127038c7a02626

SHA256
97cf1067567c7ad4b75862b8fa8b64e733a60389903003be1000ece81e3ffe23

SHA512
9e656f73a076b145466fd8c63086a47958b08e061a79fbd47cee915ed9eaf267066ec3d3e8f9159feb126be5981ef56a6261a1925661719e8f5834fa9e12f912

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk

Filesize
1KB

MD5
0153160808839bfb62d7821c21141bfb

SHA1
e3ba3ad189d7570937815eba0456e5544f725666

SHA256
c865cd50934da07fa02afd16af0ef4d1b2f3487d024083137b23f5ea3887c368

SHA512
90db318dbbf67f726047b26061bf0d17f156a66dad6f0bb6e2c317c91ea16acd257fb82be9846636417c3223c0ea67dd8428492e55773f723d32fabb34272426

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk~RFe583b7d.TMP

Filesize
1KB

MD5
96fbfbbc944d4f77670b27fb2ced6e52

SHA1
ed702a534dde014b325d510a9f079cb9f3c752e5

SHA256
d938bd0c341d6bbd310669c1038dd3c9d20990b65ef4472d1df6cb2785c167bd

SHA512
04d2b7246e923ad19f6e83b0aedec0d753341bdbbcb94bcf1ae395ba80655983ccc7ac3563d01bc22424549b76539b62ee1b1326d87b628540000d6edf4a525c

Download Submit
C:\Users\Admin\AppData\Local\Dropbox\instance_db\instance.dbx

Filesize
20KB

MD5
9daa806e84b05db2830dfceb98145b3d

SHA1
86de9eb9be3555a09865c4c2ab8495af2acea404

SHA256
842bc85705edc2d6879836631edf6e7cbe79eba2054d8a32b382547b84e4f243

SHA512
9da432d118dd6f6be98d9bcf4f80f5f8fb7528f2e20d2a8303c9a9967f382a5f1b76713f47adcfa52dd7bef8614cec96ad45501a83198b155dbaf0b3e35fe74e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BHN90SAO\microsoft.windows[1].xml

Filesize
97B

MD5
a49784c6007e88174d13fd2a1d1603c8

SHA1
96351722a846ad8a396b7cd3285ac30a8edf3768

SHA256
bf97a280596c60fa7130725b7426e7cd5ccfb759c909b5ef0b1575df2654ca91

SHA512
b0c5f6550c560e3bee33be9261bee95a006cd63a57d56b3a4b6c3c8f9ca2c6f222bfd2e8933e663f4b644457b48eb638160c8b9a6814b47a3fd4760f74f825ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5eu2fqn0.a3y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslBB05.tmp\System.dll

Filesize
11KB

MD5
c6e19f882ac7c89c517ec158d8bee0e3

SHA1
4bd07cb821aca4d2eb32e7f74ae620780d8b958d

SHA256
817929ce4af784af2f28db0eea5cc9a16fa28e8ed0b3bd497ed8dda0619207a3

SHA512
cbf559f48b66e2bdf9e0de75d48f169fe2a112e34981c1463856e50807ff05f63afb512afd99503126d9f700ed4eda9bfa45fd38ded5d55d4c8738043ec7e62f

Download Submit
C:\Users\Admin\AppData\Roaming\Dropbox\7470a884-3604-4f98-abf9-ba5f512593c5.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Dropbox\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
198KB

MD5
f570299bb768c4786cd1430b80b5cf82

SHA1
7bb9b502b573d299acfbca066a44d86c37fe8363

SHA256
892dc22eb7cae0386d1ded910b52f54cb95a5f9c1849ca0819cb6d8cd7e5666f

SHA512
999b9e817a484538a3ff53f6a7397e8e1e1f29bd9450b5f39d5d643bc8db982ffc2550853ac68e1c92d825df611409d26263d0f051d50f4c5740e9dfb42d4f5a

Download Submit
C:\Windows\System32\SET36DD.tmp

Filesize
45KB

MD5
8c0631bf0449c7bacb851fe696481911

SHA1
8792f100995b2e81f2612fc3faede772d2dfc1bb

SHA256
4c95bb59380e8037887f65f25042524f78b0f39ac1ce0876235f9c9259cef401

SHA512
c7bd044e41d7b42f1b43d403a7ca1c63648f70bf71180b476adec5e1f420d3c0b93bc64aefb1f2c540a05c941899d9f5f4ee4815cd1f493708c7d10b6eebf680

Download Submit
C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

Filesize
924B

MD5
fe4640a9b3bf3fea52ebf57a96392895

SHA1
10fe29798cf9d02598a0c1e877b538a15615653f

SHA256
f4e73222844ecef68298de68a880c5569851997279b968b24ac12921db64f815

SHA512
9c2b9bd245b7d3bc9e3b3f0219e726a945275a0f92757ff3778f05dfe76f383ec9a24d3f0b347b4fffeda4011e492baaddfbaeaca5a218b0df6b53f9d372ad77

Download Submit
memory/744-5484-0x00007FFC93760000-0x00007FFC93C98000-memory.dmp

Filesize
5.2MB

Download
memory/744-5483-0x00007FFC94A60000-0x00007FFC94EE8000-memory.dmp

Filesize
4.5MB

Download
memory/744-5595-0x000001D3D4D60000-0x000001D3D4D61000-memory.dmp

Filesize
4KB

Download
memory/744-5482-0x00007FFC96480000-0x00007FFC966BF000-memory.dmp

Filesize
2.2MB

Download
memory/744-5481-0x00007FFC96ED0000-0x00007FFC9710A000-memory.dmp

Filesize
2.2MB

Download
memory/1640-5681-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/1840-5098-0x000001B124C30000-0x000001B124C56000-memory.dmp

Filesize
152KB

Download
memory/1840-5091-0x00007FFCA0540000-0x00007FFCA1001000-memory.dmp

Filesize
10.8MB

Download
memory/1840-5090-0x000001B124810000-0x000001B124832000-memory.dmp

Filesize
136KB

Download
memory/1840-5092-0x000001B1246D0000-0x000001B1246E0000-memory.dmp

Filesize
64KB

Download
memory/1840-5093-0x000001B1246D0000-0x000001B1246E0000-memory.dmp

Filesize
64KB

Download
memory/1840-5096-0x000001B124980000-0x000001B124996000-memory.dmp

Filesize
88KB

Download
memory/1840-5101-0x00007FFCA0540000-0x00007FFCA1001000-memory.dmp

Filesize
10.8MB

Download
memory/1840-5097-0x000001B1247E0000-0x000001B1247EA000-memory.dmp

Filesize
40KB

Download
memory/2156-5604-0x000001A369A20000-0x000001A369A40000-memory.dmp

Filesize
128KB

Download
memory/2156-5606-0x000001A3697E0000-0x000001A369800000-memory.dmp

Filesize
128KB

Download
memory/2156-5608-0x000001A369E80000-0x000001A369EA0000-memory.dmp

Filesize
128KB

Download
memory/2248-5516-0x00007FFCBEA10000-0x00007FFCBEA11000-memory.dmp

Filesize
4KB

Download
memory/2248-5517-0x000001A9EFA20000-0x000001A9EFB4A000-memory.dmp

Filesize
1.2MB

Download
memory/2468-67-0x0000000003970000-0x0000000003971000-memory.dmp

Filesize
4KB

Download
memory/2664-5656-0x0000018AA88D0000-0x0000018AA89FA000-memory.dmp

Filesize
1.2MB

Download
memory/2716-5622-0x0000023FE94E0000-0x0000023FE960A000-memory.dmp

Filesize
1.2MB

Download
memory/2716-5726-0x0000023FE94E0000-0x0000023FE960A000-memory.dmp

Filesize
1.2MB

Download
memory/3572-5714-0x000001C510840000-0x000001C510860000-memory.dmp

Filesize
128KB

Download
memory/3572-5716-0x000001C510C50000-0x000001C510C70000-memory.dmp

Filesize
128KB

Download
memory/3572-5712-0x000001C510880000-0x000001C5108A0000-memory.dmp

Filesize
128KB

Download
memory/3696-5598-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/3840-5692-0x0000022BEB920000-0x0000022BEB940000-memory.dmp

Filesize
128KB

Download
memory/3840-5688-0x0000022BEB560000-0x0000022BEB580000-memory.dmp

Filesize
128KB

Download
memory/3840-5690-0x0000022BEB520000-0x0000022BEB540000-memory.dmp

Filesize
128KB

Download
memory/3968-5753-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/4128-5657-0x00000286E2BC0000-0x00000286E2CEA000-memory.dmp

Filesize
1.2MB

Download
memory/4216-5655-0x00000212E0670000-0x00000212E079A000-memory.dmp

Filesize
1.2MB

Download
memory/4216-5567-0x00007FFCBEA20000-0x00007FFCBEA21000-memory.dmp

Filesize
4KB

Download
memory/4216-5564-0x00007FFCBE130000-0x00007FFCBE131000-memory.dmp

Filesize
4KB

Download
memory/4324-5728-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/4340-5777-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/4488-5643-0x0000025DC3460000-0x0000025DC3480000-memory.dmp

Filesize
128KB

Download
memory/4488-5641-0x0000025DC34A0000-0x0000025DC34C0000-memory.dmp

Filesize
128KB

Download
memory/4488-5645-0x0000025DC3870000-0x0000025DC3890000-memory.dmp

Filesize
128KB

Download
memory/4600-5113-0x000001CEBD550000-0x000001CEBD560000-memory.dmp

Filesize
64KB

Download
memory/4600-5111-0x00007FFCA0540000-0x00007FFCA1001000-memory.dmp

Filesize
10.8MB

Download
memory/4600-5112-0x000001CEBD550000-0x000001CEBD560000-memory.dmp

Filesize
64KB

Download
memory/4600-5447-0x00007FFCA0540000-0x00007FFCA1001000-memory.dmp

Filesize
10.8MB

Download
memory/4600-5114-0x000001CEBDA60000-0x000001CEBDA84000-memory.dmp

Filesize
144KB

Download
memory/4712-374-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/4712-504-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/5136-5634-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/5384-5705-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/5832-5659-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/5856-5735-0x0000024A980C0000-0x0000024A980E0000-memory.dmp

Filesize
128KB

Download
memory/5856-5737-0x0000024A98080000-0x0000024A980A0000-memory.dmp

Filesize
128KB

Download
memory/5856-5739-0x0000024A986A0000-0x0000024A986C0000-memory.dmp

Filesize
128KB

Download
memory/5992-5760-0x000002B3561B0000-0x000002B3561D0000-memory.dmp

Filesize
128KB

Download
memory/5992-5762-0x000002B356170000-0x000002B356190000-memory.dmp

Filesize
128KB

Download
memory/5992-5766-0x000002B356580000-0x000002B3565A0000-memory.dmp

Filesize
128KB

Download
memory/6088-5666-0x000002726DF00000-0x000002726DF20000-memory.dmp

Filesize
128KB

Download
memory/6088-5668-0x000002726DEC0000-0x000002726DEE0000-memory.dmp

Filesize
128KB

Download
memory/6088-5670-0x000002726E4E0000-0x000002726E500000-memory.dmp

Filesize
128KB

Download
memory/6100-5784-0x000001AEB10C0000-0x000001AEB10E0000-memory.dmp

Filesize
128KB

Download
memory/6100-5788-0x000001AEB1080000-0x000001AEB10A0000-memory.dmp

Filesize
128KB

Download
memory/6100-5790-0x000001AEB16A0000-0x000001AEB16C0000-memory.dmp

Filesize
128KB

Download