6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe
Size

653KB
MD5

53bf221fb7136ed63e030bd819b5e704
SHA1

4c98af3c3e8c0ecb118fed9dd20651e42d02d443
SHA256

6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22
SHA512

fe871d49a27208c64d2bddd8ffc7f38d705674ef863696ca86474642adc68dd5272c49a138fef39f247c16db0d1d58350728ef1ed195968cdb442397a8de7121
SSDEEP

12288:l/iSu7Kp081EFbfcjTBJgSFghJys9WDksIiCerNc9fEiQsBc4KtyUDl:l/iPoO2jTBFAys9APGVSbsi4u

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DropboxUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DropboxUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe

Executes dropped EXE 7 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exe

pid	process
1076	DropboxUpdate.exe
4524	DropboxUpdate.exe
432	DropboxUpdate.exe
4164	DropboxUpdate.exe
1020	DropboxUpdate.exe
4884	DropboxUpdate.exe
376	DropboxUpdate.exe

Loads dropped DLL 13 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exe

pid	process
1076	DropboxUpdate.exe
4524	DropboxUpdate.exe
432	DropboxUpdate.exe
432	DropboxUpdate.exe
432	DropboxUpdate.exe
432	DropboxUpdate.exe
1076	DropboxUpdate.exe
4164	DropboxUpdate.exe
1020	DropboxUpdate.exe
4884	DropboxUpdate.exe
4884	DropboxUpdate.exe
1020	DropboxUpdate.exe
376	DropboxUpdate.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 32 IoCs

Processes:

DropboxUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_no.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_ru.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_th.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\psmachine.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_fr.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_ja.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdateBroker.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_pl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_pt-BR.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_zh-CN.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_zh-TW.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdateHelper.msi	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\psuser.dll	DropboxUpdate.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_ms.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_uk.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_da.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_sv.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_es.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_ko.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_es-419.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\npDropboxUpdate3.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxCrashHandler.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_it.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_nl.dll	DropboxUpdate.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDropboxUpdate.exe

description	ioc	process
File created	C:\Windows\Installer\e57377f.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Installer\e57377b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA26A.tmp	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File opened for modification	C:\Windows\Installer\e57377b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

DropboxUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CurVer\ = "DropboxUpdate.CoreClass.1"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\ = "DropboxUpdate CredentialDialog"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ = "IProgressWndEvents"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\CLSID\ = "{E54806CB-0046-4BCF-B389-3A6F732DC6E6}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0\CLSID\ = "{A496C5D9-84FE-4E84-9D20-7481589E1C23}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ProgID\ = "DropboxUpdate.OnDemandCOMClassSvc.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60}\ = "ICredentialDialog"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\goopdate.dll,-3000"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "DropboxUpdate.OnDemandCOMClassMachineFallback.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\goopdate.dll,-1004"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\ = "Dropbox Update Core Class"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\ = "IPackage"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ProgID\ = "DropboxUpdate.Update3WebMachine.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService.1.0\ = "Update3COMClass"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\Elevation\Enabled = "1"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID\ = "DropboxUpdate.ProcessLauncher"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ = "Update3COMClass"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\ = "Dropbox Update Core Class"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\ProgID\ = "DropboxUpdate.CredentialDialogMachine.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B\5A812990327ACD34D85B163756A6E149	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\DropboxUpdateOnDemand.exe\""	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\ = "Dropbox Update Process Launcher Class"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\ = "IJobObserver"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0\ = "DropboxUpdate CredentialDialog"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID\ = "DropboxUpdate.CoCreateAsync.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\LocalServer32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\LocalServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\NumMethods\ = "4"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\NumMethods\ = "4"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\Elevation\Enabled = "1"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\ProductName = "Dropbox Update Helper"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\DropboxUpdateOnDemand.exe\""	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\Elevation	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

DropboxUpdate.exemsiexec.exeDropboxUpdate.exe

pid process

1076 DropboxUpdate.exe
1076 DropboxUpdate.exe
4676 msiexec.exe
4676 msiexec.exe
376 DropboxUpdate.exe
376 DropboxUpdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DropboxUpdate.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1076	DropboxUpdate.exe
Token: SeShutdownPrivilege	1076	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1076	DropboxUpdate.exe
Token: SeSecurityPrivilege	4676	msiexec.exe
Token: SeCreateTokenPrivilege	1076	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	1076	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	1076	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1076	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	1076	DropboxUpdate.exe
Token: SeTcbPrivilege	1076	DropboxUpdate.exe
Token: SeSecurityPrivilege	1076	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	1076	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	1076	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	1076	DropboxUpdate.exe
Token: SeSystemtimePrivilege	1076	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	1076	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	1076	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	1076	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	1076	DropboxUpdate.exe
Token: SeBackupPrivilege	1076	DropboxUpdate.exe
Token: SeRestorePrivilege	1076	DropboxUpdate.exe
Token: SeShutdownPrivilege	1076	DropboxUpdate.exe
Token: SeDebugPrivilege	1076	DropboxUpdate.exe
Token: SeAuditPrivilege	1076	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	1076	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	1076	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	1076	DropboxUpdate.exe
Token: SeUndockPrivilege	1076	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	1076	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	1076	DropboxUpdate.exe
Token: SeManageVolumePrivilege	1076	DropboxUpdate.exe
Token: SeImpersonatePrivilege	1076	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	1076	DropboxUpdate.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe
Token: SeTakeOwnershipPrivilege	4676	msiexec.exe
Token: SeRestorePrivilege	4676	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exeDropboxUpdate.exeDropboxUpdate.exe

description	pid	process	target process
PID 2180 wrote to memory of 1076	2180	6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe	DropboxUpdate.exe
PID 2180 wrote to memory of 1076	2180	6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe	DropboxUpdate.exe
PID 2180 wrote to memory of 1076	2180	6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4524	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4524	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4524	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 432	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 432	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 432	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4164	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4164	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 4164	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 1020	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 1020	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 1076 wrote to memory of 1020	1076	DropboxUpdate.exe	DropboxUpdate.exe
PID 4884 wrote to memory of 376	4884	DropboxUpdate.exe	DropboxUpdate.exe
PID 4884 wrote to memory of 376	4884	DropboxUpdate.exe	DropboxUpdate.exe
PID 4884 wrote to memory of 376	4884	DropboxUpdate.exe	DropboxUpdate.exe

C:\Users\Admin\AppData\Local\Temp\6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe
"C:\Users\Admin\AppData\Local\Temp\6a8dbb8e513ffce5bede882f835402d13bd187597911e3756397d63b1a35df22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdate.exe
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJidWlsZF9pZCI6ImV4cGVyaW1lbnRhbCIsIlRBR1MiOiJlSnlyVmlwT0xTN096TS1MejB4UnNsSXdNclV3TWpNek5yUTBNYkV3c2pBek5MV3dNREl5c3pBM3RMQTBOcld3TkRTM05MS3dOSzhGQUo1akRiWX5ATUVUQSJ9"
2⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4524

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:432

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SmlkV2xzWkY5cFpDSTZJbVY0Y0dWeWFXMWxiblJoYkNJc0lsUkJSMU1pT2lKbFNubHlWbWx3VDB4VE4wOTZUUzFNZWpCNFVuTnNTWGROY2xWM1RXcE5lazV5VVRCTllrVjNjMnBCZWs1TVYzZE5SRWw1YzNwQk0zUk1RVEJPY2xkM1RrUlRNMDVNUzNkT1N6aEdRVW8xYWtSaVdYNUFUVVZVUVNKOSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjYzOS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0FCQThEQURCLUE0NzQtNEFDQi1BQTNFLTg3QUU0RDZFREQ2Nn0iIHVzZXJpZD0iezc5NjM1QzBGLTlDQjAtNEIxMi1CQTQxLUIwMDU5RkZBRDkwRn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBM0MzRDE3MS05QTVCLTRERDItODgzNy00N0RDOTNGRjE1OUV9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjYzOS4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4164

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJidWlsZF9pZCI6ImV4cGVyaW1lbnRhbCIsIlRBR1MiOiJlSnlyVmlwT0xTN096TS1MejB4UnNsSXdNclV3TWpNek5yUTBNYkV3c2pBek5MV3dNREl5c3pBM3RMQTBOcld3TkRTM05MS3dOSzhGQUo1akRiWX5ATUVUQSJ9&nolaunch=0" /installsource taggedmi /sessionid "{ABA8DADB-A474-4ACB-AA3E-87AE4D6EDD66}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4884

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SmlkV2xzWkY5cFpDSTZJbVY0Y0dWeWFXMWxiblJoYkNJc0lsUkJSMU1pT2lKbFNubHlWbWx3VDB4VE4wOTZUUzFNZWpCNFVuTnNTWGROY2xWM1RXcE5lazV5VVRCTllrVjNjMnBCZWs1TVYzZE5SRWw1YzNwQk0zUk1RVEJPY2xkM1RrUlRNMDVNUzNkT1N6aEdRVW8xYWtSaVdYNUFUVVZVUVNJc0luSmxjWFZsYzNSZmMyVnhkV1Z1WTJVaU9qQjkiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy42MzkuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBQkE4REFEQi1BNDc0LTRBQ0ItQUEzRS04N0FFNEQ2RURENjZ9IiB1c2VyaWQ9Ins3OTYzNUMwRi05Q0IwLTRCMTItQkE0MS1CMDA1OUZGQUQ5MEZ9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7QTJDNzc1REEtQjAzMi00Q0RFLTkxMjEtMDhBOThGMTU0NjQ3fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0NDNDYwODBFLTRDMzMtNDk4MS04NTlBLUJCQTJGNzgwRjMxRX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODg5IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57377e.rbs

Filesize
7KB

MD5
def55c50c2cf5ba2765a7f37070e82fe

SHA1
fa69d145e831ffc24b21d93a943f8e3077549e00

SHA256
ed2adcb7069ead4b9eda2d87fd100b05e85d3869c906cbebd454e663bff684b5

SHA512
12a2ce947db131452fda41c9bfc991c2aae68fb84a5f5e9f584c9d665a5a73f36004d8e6144441a4b7b38f9dc20a0d5481234edf26e022659aeb6e97cb78f042

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.639.1\psuser.dll

Filesize
211KB

MD5
d6ef3bd5cf6aaf2beb7ab2522a4b87c8

SHA1
ca1e31529d7373f279f95e27b766950d640b0e8c

SHA256
2519303fd988ae8efaa15e7c8a294135565abbfcc94bfa4610ee0b66b002eef0

SHA512
916993d6a854810f55bbea647af428f5fd322d720513624c5880e7969133e12c886d54a4ecec951cae489e167054e1eff654c7c6983d17c082df99214b084a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\@PaxHeader

Filesize
27B

MD5
50dd61fb1b803a8d6e3fa2d8400c54f0

SHA1
d608f384e60192b5573dc92cb164d53f23ebc257

SHA256
57748746891a3a70063c80f2a9171ad267c3d57d33e317ea3b38d5c79f90260c

SHA512
8098ee2ac5a60d4bae513bbac3bc2dbd5f303378b793886fe3dfd6089c7bba9317f7d31603a970ecd38317a16a2ebb9eb24554351440a4703ce3b7c268b44386

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\@PaxHeader

Filesize
28B

MD5
a340a2bd6caa3b386806bf18da44540f

SHA1
22d4579bd624b4f38f1d1ce88c3b45dfaa4cec11

SHA256
ce1319ec83ddcbe9878f1168567ededbde8efaf33398966d5bb25203da390887

SHA512
3ccb6a3b0ba7c9c10ccab79716c223c2b3f49f191a8fb01f10ce73825ec974d29df1ea179fee2418245b7287245394e85abfaa5546c0635084ca6989fe91ca12

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxCrashHandler.exe

Filesize
129KB

MD5
5ecee6fc156527757209c82a4edf19ca

SHA1
653f9234e467efce1fced8b3885047fc13a2b9f3

SHA256
c8d370e15e744b49c46bd0f350d5474541a5ca17b0b438db2ad76733127f89b4

SHA512
795401d771f4d5f94a8e2507c0169acd678327f854eb64548b0e665a5586614f5f96ec52f625543010d1254308e9925cdf8cb98a2b69c18ee9053364b1997151

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdate.exe

Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdateBroker.exe

Filesize
75KB

MD5
cfde3292ed966039846bc5b321bff1b2

SHA1
3ea1222f920b6534e118cd7170b3df9c6a62dc7a

SHA256
d97b011e58461d7c2ad9c2226f185708836ce1971de8fe2bf7deeac81e54f89f

SHA512
0976a8330e90b4fe7e85761dde9897ea08b3851d4dae0107fe4aa3179c9a4e08201dade6912df84ac467fd4146b098f5beaaaaf6150109b9bf5c6fc4c2f3d9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdateHelper.msi

Filesize
26KB

MD5
d78d0fe3a00f46774880f12e14f7394c

SHA1
62e4d7ddd5e46d227ca2e571daa1e466f64bea66

SHA256
08ea4b27abcc2506163f41d64611e29beae769e2fbeff6ad374723bba9520827

SHA512
64d081f9562aea4729531713f8483cc97f1cc0f5317c5a39d5036088c9a3808fe5868bc07d7e87113170e7e6e4b7e61fa79a20e4449b69874d10de1768d30018

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\DropboxUpdateOnDemand.exe

Filesize
75KB

MD5
2b361afa23729bf6139b99a1168957b6

SHA1
eb07cfca1d372eb59c4a74de9236b380c076dfae

SHA256
3d6efe7c4671b3e11a09b3df7a1fee3434dd6b71a43c10bd9181e10a1e7941e3

SHA512
a63e46dc5d1a85593f11a529f8f4ef2fecf9cce6369b0244d9f70e1d99953473d1cfd6aa94af9e9e2cdd0493b2e6c96f9a5eaa8af35ffbc5834f66d3edb46b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdate.dll

Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_da.dll

Filesize
32KB

MD5
1301bc60c2424f69f091ababcc86f8cc

SHA1
6206159e28a00531876e9ad6f0093b945cf91c38

SHA256
9a48be8e60d43e968f6600e73391c97ed4cb9661dd1e917d335d014bf1e7b228

SHA512
8a5e1296d92dd8ac66d577efb75a5191bc27a881f8779b208322ad71f7cf952dc316f223be462f0776dd216505bb8c019c91c54dab5422f677e795f35ef60837

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_de.dll

Filesize
35KB

MD5
c5e6a073fffc6683cde32b96599c7725

SHA1
7592cbce63335a407f207fa6ae8f0956f0ddd0dc

SHA256
3a01c8cd5c2a586ca17f724bbfd526d1801d1697992f2993d561c190f55da0b7

SHA512
b12c890143eaea7d5d28b41666833eb29298b4a68ef6eebcaf8b8e59f97d5e8bbb303ab631681d9c7d5d39efd5656360dff42a8cc5545fbef3355d26e4b11e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_en.dll

Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_es-419.dll

Filesize
33KB

MD5
7df80b6d573b6b3dcf6a4a0105ada9f8

SHA1
890a90f7bf97615a085712e82747feee724f8e75

SHA256
cc3e874c666cf935b3f1ddc449a946236aab95589fdfc05f631c92dc47576d0a

SHA512
e593218873793618aa930a1c3c2c17235d6abe0abf8985f50afabd76cbfe89d4e932b853020adc0043a0b47200231646a5424356e99ea8c0d8b20c580a230fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_es.dll

Filesize
33KB

MD5
86c2d7187b461398c58bed0c7e48d93b

SHA1
6f82a85337ec02f14e72d6697fef5b9d120c2447

SHA256
509b126b249def0468be289fbac4ce959059c1c3b982e7670a39291f67ac5a6b

SHA512
f32609b9976d60d129255b14e42a7e00cdc974bb41509512cf793377208c0fa6c36cb3ada69d1064804f497e0c1566926bec5b19a8b2b287c6d84d1e8d8dd9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_fr.dll

Filesize
34KB

MD5
47d6198d8afc654b1357f886d51390d2

SHA1
e143e62ecc00246f13ce710cd68921d78f8d5258

SHA256
0b864b03fa21e972935b028f3e3e5c2b344e04d84bf8e844fded43d5c6f13ef9

SHA512
433708332cec3bf639e53522ae62b4d89689ac0d918ea5546fa25690598bf7a0600d3dc853cdc1605d569f04f49a2b76f3fd3d1281c6e92a65fbf10901d6b278

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_id.dll

Filesize
31KB

MD5
b4972522aa429f03d3ef5cb1cfeb4275

SHA1
339389e671082d74954efc8ca78c4354383eed9c

SHA256
3d4983be545b604a083f0aa4e083b91037e015ac7db6a4b4d878023b5d9ef58b

SHA512
30f2bc58a1d97b1ea809bffc93d317573330877653ea180553ec57f8d98dff51aadc393a1ebe7b19eb992283122703a505b77cb7f054954f20efc202702f734c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_it.dll

Filesize
33KB

MD5
dd28fafdd50ffe47460bd6a7ed845b03

SHA1
6331f86cb24014c2e06033802171d3339a013bfd

SHA256
072429ae6fb3a7a2d145bfa7fce3be89f98d75636238ab665294500bac45d89c

SHA512
f5428a9350ab8b029423562f1fa75b7b5dc1cb03b2434cd15bbbe1224fd711d50304d7857320ce4d6499fd8e112e9e5edbfd115bdbdbc26fbcb383d96411e5e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_ja.dll

Filesize
27KB

MD5
750f92b58c34c03651cad14fd0eae455

SHA1
59e4130a0131b02994901e32575f88f6ba8e54f6

SHA256
3389597240ddf453a4c396777ccf80fafd7fa80aefe8ff9ae5a4ba924323f703

SHA512
2a023bad31f3e18134cd4400f669291d7fb4740e5057d0a8162f3f5e949b0f9f556f403cb1f2c337797872374fa8102b0c8b6df5130140d87517b93b7e9c8be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_ko.dll

Filesize
27KB

MD5
097ac7365616670974c6f39660938ff6

SHA1
6167611b08fc3f3b23018cb9d05f015c642004bf

SHA256
acfdffd0e58a985518363f4c703ceb4429b5470cdc62404e0a9b9af3fe1726bd

SHA512
705eebfde9211cf5b9f66589eb42b0d27274ecffbc0b9f706e1141a1b357f2140d4c6760dfbd97b44a2ae69821b44f9c8df259c84591e093209163f06397a1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_ms.dll

Filesize
31KB

MD5
80305b659dc0b77578476d179f5e5a56

SHA1
337f00f964eea37ab0f3d7bef28ae0abfc46d509

SHA256
6aa2021733ab522144d16567253d565f95a3bae548995c8c7412405a9a4dda6a

SHA512
46658f76570f61a72577342c8506a700a7028c2ba9859246f1a119cf919c32d3836eddbd92bf83974c987f661e0c99dfee75d85cca46684d0b8d8a6e03325a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_nl.dll

Filesize
34KB

MD5
f51d31df7a086e6c001686086f977d35

SHA1
5407e4f85e279d2bc5a5336bf109ca0c46c91e0a

SHA256
c046cbca2d077a222158a2d95f6cbfa229e8032a2395be6e16a1565917a65246

SHA512
d1799a43beef4f3c70ac35497d10260ed324bca62f212082bf72a70bd1edab7ff48f2f5e87c7c5d9d637a5883297bbf62efeeec546a03d975877e13fa2bb88a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_no.dll

Filesize
32KB

MD5
b6615b35d0905c9ca2e39678bf85bfc5

SHA1
62de31d5f991cdcbeb967ab309e3bd054927fec7

SHA256
dde7f7dddccba5b3e234e7a9af2152035ba1a044f27fb2fac65f709479ae26a6

SHA512
403deaf8a94cb5422f5749ec5c437380c4da1654e5d44910408f3681cb9a7909d841a5a38c9c6cce21fe7203581edbae655d1bba2c1caf46b1b0f906c5ca1451

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_pl.dll

Filesize
33KB

MD5
0dac0bbc2244b10d540c8b07dcc331bb

SHA1
da4acc32d893f1af61b779d3257f97779c948e7b

SHA256
e65adf5cf4eb50b041855400440095c9ac9fd828f717483ef8aad6737cd170a9

SHA512
f5c698f22ebdcf8e6f241dfbe31251222043ef3367bb008f2d0e7fa8d9a5c087ecf006153d12a08baf0c52c9864e8910af6e60c21efd22c7c37bc720bc185516

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_pt-BR.dll

Filesize
32KB

MD5
7aacf25f28084badfd5c6c9850ae8f0e

SHA1
122da522d5bb3c28b20128b80a4b70159711b793

SHA256
f76edb5594f35563894f6d67c70a5fc6e200b4e00145345d72d83d453c516402

SHA512
dde22d81a0cc81ca506649fc43b43f02a19c0f2dc14d0a76a97ca10d2d666c942e361221bc2a2f38550b3e7d5f86b62a6c0efac536730ff11144a91a8003df1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_ru.dll

Filesize
33KB

MD5
abd331d37909e716ec5d35bd83b8cec3

SHA1
6ffdba22f3f8bd9007f69f94fc01d1381843f9fc

SHA256
d916fe1ca6a7ffeeeca2032a765db9c962dde321fd7e293d403146ab92c08467

SHA512
98f0c72e8684728f86d53232ede862cdc65a6a0c527fcfbdea4a889526026cbc5608acf0ea14a46ed113d43b03c8cfa01d1ef9dd015abee9b20c9f2de9a14626

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_sv.dll

Filesize
32KB

MD5
ef762fe5636b17c491444e886dead158

SHA1
48e24cc58b4d402bdf6a40454cedeb30df72c708

SHA256
eb54da8396fe8ffe32c416357a6cebd36092cdb17bc3aae10ebf1d035abd9473

SHA512
9751abb250243d281b052ad56109fcb08390082d88307c4c930ffa25bbb34c849d54d7258e83e8c6ea51165aa9f8540e15b09f93e4a4b35bf8140de68289ffc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_th.dll

Filesize
31KB

MD5
267fc12ea91ff17401bf6f59f695d1ac

SHA1
828315d0e1d3bede5c49e8df15164135f6c4150b

SHA256
e698f6be6d98549b7c01149d892fc934951534476715235d28c6afca30ef0958

SHA512
da982cf7698dd48751e1b8ad73251f35e5b71f80401a1e430fd1020c9eb9f26d3dd3226f5a7af49613df1ce9203d4e83e23d6ee54c7e4e49113cd510a9a057d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_uk.dll

Filesize
32KB

MD5
aa09c8a1c612c494292a47fd07d1f2f9

SHA1
eba0dab28e9adb8d45b93b86697a6f2d9121264b

SHA256
a9737cf7ccd2f05eacd65ba898cd5084c9ea0c264d826803adce72a1691b228a

SHA512
59df99e57bfc2ea53a2732cf1c18d417f725eab2780f18cd56d10ec6786974d16df6763ea00c270bba666a1946b29ba40b80194680b6391e41e060e27d449714

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_zh-CN.dll

Filesize
25KB

MD5
4115e2ea20b4faeef97d419595e993ef

SHA1
dcd23fa5536c9c5202e934bc8f43ba1ee33cb2e9

SHA256
17c88571ef3929a0d50df0211135a95d8aa0eb0ea1fc69c0ab9b36a7e1432a61

SHA512
828ef190e204f83d0b2c87a6fde74f9ed2b5550c9cdb9c6c48699ab3912bc3b4a6f76673b1bcbf8dade7756af72c9afe4e411d5ac15fbcaf2cb94eb4b6d6db6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\goopdateres_zh-TW.dll

Filesize
25KB

MD5
d4852f657e4ac4fe693f62f336bd275f

SHA1
f407950da73032ed2f30e918ba69e6b42fb6d938

SHA256
ee9eb7898c451a1ef7756b5c721f03d452deda45a99fea3566afb8ab1ec46d1b

SHA512
9fd012bdb3dc130d045d342ceab0dec154db208001cf4d84d576e787645c5de48263d90969d683cca107a14687928ebd938c0b8726f883a6231c7fe6923acb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\npDropboxUpdate3.dll

Filesize
273KB

MD5
06e53e63294e29d1da4312a357b5b68c

SHA1
3ee051135178e79d5a8009afed483fd21ea1a95d

SHA256
6191829d054a53ea394a26a57f72f7dad4b683c471da341d09cf27362eb5942e

SHA512
e5463c844e60bea5e502e460fd03358a3f083053457135c5dbc29a32820593662bb34ce60224df612d2d5a0313a89d14519fa9a79ef0181ac88d087d36ebc7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3170.tmp\psmachine.dll

Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

Filesize
924B

MD5
acb8436d302f394b1896db9d93e48402

SHA1
0aa402b98147883809f0f0082dc02bba98e40c5f

SHA256
9bacbc456b599dfd352d04953b696cf31f3e44ea0da3d2e319fd3448bf74714a

SHA512
5288d53e5d7f1e7bd570e2c973a5a72a4066fc585bbccb9aff0129a2a60cd52a4353f259b77b1d74d8745a3a548de62443fe3586501865e12ecffdb5b76a1207

Download Submit
memory/1076-72-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download