c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe
Size

632KB
MD5

71b4b6cc264b8fbe14650747d89b9f93
SHA1

355d08e149965451a11be67d61e512e931847078
SHA256

c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266
SHA512

172d923afbd55c36b0b3cf07cad508aabdc66e01d8a2929c1e7aa5a197b080b80c1e786a879405dbf30e7c968bc73007922bb22ec5d1660aa704a9c3e06ce37a
SSDEEP

12288:q/iSuokQiMXBLfzYjnlJE1xl444clzKbtDf4TclbwO0dJYPjfWrhrn:q/iUbVKnHEva4plzKxT4TclEO0yjM7

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe

Executes dropped EXE 6 IoCs

pid	Process
4716	DropboxUpdate.exe
1840	DropboxUpdate.exe
2484	DropboxUpdate.exe
2812	DropboxUpdate.exe
6052	DropboxUpdate.exe
2472	DropboxUpdate.exe

Loads dropped DLL 12 IoCs

pid	Process
4716	DropboxUpdate.exe
1840	DropboxUpdate.exe
2484	DropboxUpdate.exe
2484	DropboxUpdate.exe
2484	DropboxUpdate.exe
2484	DropboxUpdate.exe
4716	DropboxUpdate.exe
2812	DropboxUpdate.exe
6052	DropboxUpdate.exe
2472	DropboxUpdate.exe
2472	DropboxUpdate.exe
6052	DropboxUpdate.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	5464	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_fr.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ms.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_nl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ru.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_zh-TW.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateHelper.msi	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdate.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_es.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_no.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_th.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_zh-CN.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_uk.dll	DropboxUpdate.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateBroker.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxCrashHandler.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_da.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_es-419.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pt-BR.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\psmachine.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\npDropboxUpdate3.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_en.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ja.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ko.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_sv.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\psuser.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_it.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe	DropboxUpdate.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Installer\e5737aa.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5737ae.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File opened for modification	C:\Windows\Installer\e5737aa.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI398E.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DropboxUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	DropboxUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CLSID\ = "{3363994D-A786-4A32-A745-48B9B6EA709A}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\CLSID\ = "{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.503.1\\goopdate.dll,-1004"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CLSID\ = "{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ProgID\ = "Dropbox.OneClickProcessLauncherMachine.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID\ = "DropboxUpdate.Update3WebMachineFallback.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\NumMethods\ = "24"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID\ = "{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\ = "Dropbox.OneClickProcessLauncher"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CLSID\ = "{9E396485-96EB-4906-B2C5-3E0F1E7748C3}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\NumMethods\ = "6"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E18222D8-898D-495F-9D20-460324C7271E}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Dropbox Update Legacy On Demand"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\ProductName = "Dropbox Update Helper"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0\ = "CoCreateAsync"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.503.1\\DropboxUpdateOnDemand.exe\""	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{100E51EA-9FF9-488A-AAC5-A6DBBF8C41D1}\InprocHandler32\ThreadingModel = "Both"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\NumMethods\ = "10"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\NumMethods\ = "10"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\VersionIndependentProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer\ = "DropboxUpdate.ProcessLauncher.1.0"	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4716	DropboxUpdate.exe
4716	DropboxUpdate.exe
5464	msiexec.exe
5464	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	DropboxUpdate.exe
Token: SeShutdownPrivilege	4716	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	4716	DropboxUpdate.exe
Token: SeSecurityPrivilege	5464	msiexec.exe
Token: SeCreateTokenPrivilege	4716	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	4716	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	4716	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	4716	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	4716	DropboxUpdate.exe
Token: SeTcbPrivilege	4716	DropboxUpdate.exe
Token: SeSecurityPrivilege	4716	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	4716	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	4716	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	4716	DropboxUpdate.exe
Token: SeSystemtimePrivilege	4716	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	4716	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	4716	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	4716	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	4716	DropboxUpdate.exe
Token: SeBackupPrivilege	4716	DropboxUpdate.exe
Token: SeRestorePrivilege	4716	DropboxUpdate.exe
Token: SeShutdownPrivilege	4716	DropboxUpdate.exe
Token: SeDebugPrivilege	4716	DropboxUpdate.exe
Token: SeAuditPrivilege	4716	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	4716	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	4716	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	4716	DropboxUpdate.exe
Token: SeUndockPrivilege	4716	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	4716	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	4716	DropboxUpdate.exe
Token: SeManageVolumePrivilege	4716	DropboxUpdate.exe
Token: SeImpersonatePrivilege	4716	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	4716	DropboxUpdate.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe
Token: SeTakeOwnershipPrivilege	5464	msiexec.exe
Token: SeRestorePrivilege	5464	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4716	4512	c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe	81
PID 4512 wrote to memory of 4716	4512	c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe	81
PID 4512 wrote to memory of 4716	4512	c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe	81
PID 4716 wrote to memory of 1840	4716	DropboxUpdate.exe	84
PID 4716 wrote to memory of 1840	4716	DropboxUpdate.exe	84
PID 4716 wrote to memory of 1840	4716	DropboxUpdate.exe	84
PID 4716 wrote to memory of 2484	4716	DropboxUpdate.exe	88
PID 4716 wrote to memory of 2484	4716	DropboxUpdate.exe	88
PID 4716 wrote to memory of 2484	4716	DropboxUpdate.exe	88
PID 4716 wrote to memory of 2812	4716	DropboxUpdate.exe	89
PID 4716 wrote to memory of 2812	4716	DropboxUpdate.exe	89
PID 4716 wrote to memory of 2812	4716	DropboxUpdate.exe	89
PID 4716 wrote to memory of 6052	4716	DropboxUpdate.exe	90
PID 4716 wrote to memory of 6052	4716	DropboxUpdate.exe	90
PID 4716 wrote to memory of 6052	4716	DropboxUpdate.exe	90

C:\Users\Admin\AppData\Local\Temp\c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe
"C:\Users\Admin\AppData\Local\Temp\c4550516c3a607a28854c78323bad04c9dc40a5b8a78a11b057a0e30ef5b7266.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUThvNHdLUzB1Q0s1S3RrejNMZlNKS2pBUE1TejFEN0xNOEktSWlzcHdDa3pXTXpRek5qRXlOREF3TVZEU1VWQXFUaTB1enN6UGk4OU1BV28yTkRZeU16TTFOVEkyTnpJeU5qRTNCcW94TmJNd043Q3dOQUdTeGtZbTVrQUJrMW9BQXhzZ0JRfn5ATUVUQSJ9"
  2⤵
  - Sets file execution options in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1840
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:2484
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVRodk5IZExVekIxUTBzMVMzUnJlak5NWmxOS1MycEJVRTFUZWpGRU4weE5PRWt0U1dsemNIZERhM3BYVFhwUmVrNXFSWGxPUkVGM1RWWkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VGtSWmVVMTZUVEZPVkVreVRucEplVTVxUlROQ2NXOTRUbUpOZDA0M1EzZE9RVWRUZUd0WmJUVnJRVUpyTVc5QlFYaHpaMEpSZm41QVRVVlVRU0o5IiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTY2RkJDOUQtOEEzNy00N0ZELUE5Q0MtQ0IxODZDN0ZDRjkzfSIgdXNlcmlkPSJ7RUVGRDI1ODgtNzE2NS00RTZFLUJDMUItNUMxOTQzNEI2Rjc1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc1QjNCMUVDLTdEQjYtNDg1NS1BRjczLUYxQ0JEMzJDQzYxMH0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2812
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUThvNHdLUzB1Q0s1S3RrejNMZlNKS2pBUE1TejFEN0xNOEktSWlzcHdDa3pXTXpRek5qRXlOREF3TVZEU1VWQXFUaTB1enN6UGk4OU1BV28yTkRZeU16TTFOVEkyTnpJeU5qRTNCcW94TmJNd043Q3dOQUdTeGtZbTVrQUJrMW9BQXhzZ0JRfn5ATUVUQSJ9&nolaunch=0" /installsource taggedmi /sessionid "{166FBC9D-8A37-47FD-A9CC-CB186C7FCF93}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5737ad.rbs

Filesize
7KB

MD5
da9b2f5a10ba6dbc5b8145a69d4a4526

SHA1
8ba4a5080d0a0716973f8d0ea7cee9753fd72fce

SHA256
17767b22f7f0a0c0ed9de611519d9c5ea0a3d81418e9965fa08f7ba5e18d22a2

SHA512
2381980f063ee5ce8f52c18db8ff5a32c69fe89544c581bc09ee5a606f01001be4747578cedc734df1ea8817415940f2f36d3bfdf9b7fd3a692504bf2a966acb

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pl.dll

Filesize
30KB

MD5
619d783f82f4074bd698e70cd7c0cb2a

SHA1
843942bb4a6f4fba47c727815f61271f7546d031

SHA256
e0b061b34a859f45c8e322d1d454bff9e345a2969f3cf79ef26f91f3a53bf432

SHA512
51c64733021d6243a6ab8829d14c6ea93c0bb9d1c26720ca8c1885f1277bebf9d5b87978237c6efd0a74d7e0c7194b9195c3d56ffac06367b47c564182358f22

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pt-BR.dll

Filesize
29KB

MD5
487df036e56a8fe0831a562e8ca0f612

SHA1
09b544c47d1b21bf53d6fb164a309941020783df

SHA256
2758ba08f78ba798d25a2e68ad3f9a13a3274a9a7a33422d165570a14b50fb6e

SHA512
049a5346870a341ac7f26f95e955801d535d4f483e96709e8e26c645e1a20a066d2676b73425a4c16864040f6f81f043dc1c3c8230b321350fdceca11510cb88

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_sv.dll

Filesize
29KB

MD5
94e6dfa058481bc79a2f69175ec5c332

SHA1
81aa442a9126783a6496c326307fa6294ae715e1

SHA256
14827356855850c7dad9e21616aa1e4432bff8c870eca557aa8d5060abecb740

SHA512
7714842feb420f87bd11349e122b88d275842dee427d21e7f6b72cc4f8e337bf2d1f208983a714428bd4e020f93fe1b43adbab718182b6e4dc9d61fe116256fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxCrashHandler.exe

Filesize
126KB

MD5
b108281fad84939c0f85d5e666ab0814

SHA1
0390a0e31922f1c6e318d6c4fe774e7ac61837eb

SHA256
b6f2afd4a5442c197959162f657cdb22b640adb0d4ee261e1186ddc8c55ef815

SHA512
c28686077a380e584ed472715ae8e2bd5c8b6f3acfe17767a3dceabdadcb42f0f1c24a2a145631f1aac5289044e06754a0937d44f922e780977fcc94f31637f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdate.exe

Filesize
126KB

MD5
e67aab913a3b8365c1fa336ec86edd0f

SHA1
decee6e1704d9bef26841c39e60abc88850f770c

SHA256
e720b05e5bc033c8cd48be3d88bf29af9ba51eeed489d6ef23d64f8b99d5648c

SHA512
72dede9036d3e921cd5395b3c31c6375a36a05c8a5006b3fe134002959ad3bcdd87eedee3f40afa673700529d00ccf4ac3d07c39c2780cead4dd3e3f90a207c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdateBroker.exe

Filesize
73KB

MD5
bf2caffebc9cce469b835db5727a28a4

SHA1
2b33955db3cd40d48868d55d6144b27f86d50e82

SHA256
4df6688660df75e4dd667d0f29b3ab6f24aa96b4d551b9570f9717cf26cc2f63

SHA512
f1ae1f4d43d3e97716b8a637eee39b8a508ecb124ec466a3ab883d6e11c39731611efc56ee500e1cd2cc45aa503b46242b251eed6779deac8f32c1a677c4f033

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdateHelper.msi

Filesize
24KB

MD5
2dd73adac0d93b3257fd3eb307d51979

SHA1
c8d5061924e3631a15be9d57efb4894d48c0f72e

SHA256
6c056b84dd5d6804bfc05bf502d3d81bf7fcc21c3006b7f35e8dc0e1314b80af

SHA512
5aa1136008391ef94c36ba9405265961245b07021cdd80c089fa3887e441d38545588434f4f9959d84b736882c20f209a6d2ae8d3797639da7bc4c388ed9b3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\DropboxUpdateOnDemand.exe

Filesize
73KB

MD5
0304e8b49fb0ec5c3d44346c19cbabdc

SHA1
fc9dcacbe95ed627d3785579d7b1b1b278b6fdf9

SHA256
948dddfad908582eb397862d377d2c25de3a04b561fb8ac041f8397c51ac65aa

SHA512
a29c6fb19fc066d7623761be2f98bc566a5483e25c6273aa50647e826dd464a89fa498cbeb8393a42011d8897fed712a222d83cfaab5a4ef0420e1548965cf7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdate.dll

Filesize
1.1MB

MD5
ae63fca47832957cfe612c182f160431

SHA1
472a270e83bec3551c6d65d2e81fe653c819849d

SHA256
f949cc14b2457acc381a97c158e468b581658e779585cc87a8b9f6c250123f24

SHA512
15d8e801f23a1bdd7c97ababc40edaaf01803f3e1a97c2f3a02f2d180f1aa8faa0bb3cc69d797456260c100e0890a734784f0495c3175eaf49c05c2ffa6e4c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_da.dll

Filesize
29KB

MD5
7352b8c512b95545d2289ab35fa74f6e

SHA1
62e362927c55a2e8259ade7b0ca6922109073dbf

SHA256
78426a78f89135d8ee9f924e366737afaf2eb2c0c82c7c18c496bc763e42cc78

SHA512
4e65e3137a794425271a4c1b33b6064329727c8c9da46bb74c04a6f2d9387ee897368b566e10c01c68d46aa2e251f84c11c9af03dd5d2aef4d1b401cab4574fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_de.dll

Filesize
32KB

MD5
339ab3d963f4d9b2c13e48ed045dbb5b

SHA1
faf05f2713bac43be1449681df2dc0ebae7c6c86

SHA256
62bfbbf544d3420fb9dbeb48b2aa78702e42925e68f880096fcca52897bbf09c

SHA512
dee5fbe1270e562ff12d11e152053f3f0acabeb6233edb4d2d4672c684627c33a034a412302fc311c2aaaba219c43cdf9b420731b13b0126e7b2eb6a857e1036

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_en.dll

Filesize
28KB

MD5
743d35e1766c961cca9364fb6743110b

SHA1
516f884ae7027d4f21ea03b4887b187ef9d13495

SHA256
b0100feacf0d4a6b83c9a69ae80c050d59f277b2748e86e421607113bd3869ec

SHA512
a7ed4f6c0e8149cbf54f49b261afaa1a49dd9c1ba0959e144f5cfedf91b99c49c200af23c4bc04fb767769664c6c03e67dbbf255d9e60226f93feaa4952389db

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_es-419.dll

Filesize
30KB

MD5
60ee4ba1c43e52744c42921bd977f83c

SHA1
a4332ccbeebeb41c4a0e5ff96a8c72213b5d60db

SHA256
d4dfa2db01c7d54c373974aa60f1979604c96e5f972eb58783f64a8dc5f40ab9

SHA512
98a57bcbfde233a9dbf69043df190d4042c8ceab0a0f0b9d6a1727b8c7a3264d5378ba88ee922f7232d86a489f62e0c98e9915c3513fd6c5ae437c040c697e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_es.dll

Filesize
29KB

MD5
d2b84c50183add60407bb9b265d62b7b

SHA1
7889bf24cd6c60b4d0018bdf09241d50caaf5535

SHA256
b518c890a9470a10a2d249b331b36e35f7908895d405901c1fc2143529e5053a

SHA512
1f5157cf788229ed4a63d0201b5cdf4d3027492a766d83f2f7bc8eaf74643db749c2e64b9cfc93e049c862de566de8c1212f1af57c2eb009a509b34673d67864

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_fr.dll

Filesize
31KB

MD5
2c565a0a286d04a01ebc7d6b730a1abe

SHA1
6685d0a15180cf1a0e15859a0d06952581d28a37

SHA256
841ac06920dbec0479a646acdb425f0de8a3dc718deb8b89d6db9d3fcf5127b2

SHA512
067148dc7e7c2914ed66069033c2b545002f89d8a85ee8f54e3894f6991bc32a5ff7eb25d1f8f1ec996bea99da3b2b6b7d5e48e2132c4d765c212aa5b8ba1d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_id.dll

Filesize
28KB

MD5
e22219dd76a58c9519272dbe9732feb5

SHA1
4698d37ae511a4310b3c4e974d8ca695bebd0fc2

SHA256
9f58ff7ee99951136488d7a068f93f354ae1c0fe2d241f5797ea446b1e5ec6d3

SHA512
b7ba3f0361ffb71da568e75553ecfcb21fd1f5d1d3411e442acddad69dc52e47f95e17c84e38642f68ca4ed993dd6789213e8636061699aabf6b2284b52ab427

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_it.dll

Filesize
30KB

MD5
bea99abe5ad6d5c8520915039a91aced

SHA1
1a3d1dda5c3eed9aa084c704cde4911d111f5cf1

SHA256
862ba228fe81ef95d30c43331bb7be769c77ea463d4ef05dccc6dd772e1474b9

SHA512
90db87e50536d9fd8d0ea393898e05984197ef020feb6a2ecd5efc61b95094cbab42dc42e6485e984d46c15642cba6839f9a27fa5e68f40d6e06f7420c76fe69

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_ja.dll

Filesize
24KB

MD5
39be5c1e2b0c2c8b339dd0a57fdac041

SHA1
d7a58c18a02643d3cdab6e73a161f4bbf9f4bcd9

SHA256
1d783a15befc72b76ac3ca077c1fd9645462a42a9d06cf2b47c06eedc8ff3a84

SHA512
2f1e74dde409d2ede51e60ba5524066a2185e2fefdfba733b36ddca12720854eb2656adcc980ad84c517a47fc00aac24223785766bc47a2c6ee1a2fb72207bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_ko.dll

Filesize
24KB

MD5
91beea2d8f6c24517cd77742427f08ab

SHA1
76b3df167e153574bdaaf5876cde206c02d411d1

SHA256
66f5a74c03fc8ad4d582c6cf4f6972cb851efe62a1bc520af09274dfd3d59b1c

SHA512
d5271f7c31f4de8d66a4c216d9b2587f54d0ba2ecb8928c8d776dc1c264e2e82dbb8e5e5f2b2425b964560e6d6f01cb35d9b65664f2c2cd83c84d0d609d283a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_ms.dll

Filesize
28KB

MD5
dc3d2532e16bd742cd405d4336222c40

SHA1
aa8e9e9531746b7b6940267113f7c78f6355b632

SHA256
f6ed38bf762df998589f17d6f7293d347fad019b21990943f0e13346f7030097

SHA512
ce5581d3da5e6c78bc867ec1d9ec6ff6bf8b95626ae1b4b1128cc5db1d7247bf212f2dc9b740b5b6c602ba609fd25752db6affd1a02de79885a65cec63c9454c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_nl.dll

Filesize
30KB

MD5
ea2e2791a966eda8ec1416b28824ce93

SHA1
f39dfb95a88c60d58edcf73a3172f500d92208f2

SHA256
31863bfe9cfa56314c16c124854c8b6c2dde44da9986015a1829c22b1340398e

SHA512
525605ecae61307a2f6d5ea57062ec0b08b54a7aa0b5a2abb993446b201f342af5fe39d2c73b81c6544a04908fecd3bfcf5ad0f4c831d7cc33cae3b58740393e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_no.dll

Filesize
29KB

MD5
ed6410ab442d7e5337c97aa2c65d3232

SHA1
063bfa594b9abf54af2fec7c106cb2aae07f1bbc

SHA256
ca2b32de1a864b069196d3b4e6734ed7bc80dd29907b1bd717d658cc2ac60c41

SHA512
e5034db1a4d6d656dc2c63daea969fff857e9c7cffe4500d8d8052d4aee4fad703527d94c62deac4680d94721d4ad7ddabda21ce1f38e5ab8adee11ea18a40c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_ru.dll

Filesize
29KB

MD5
8fd3deaadb1d1037f1fe5b46112a9653

SHA1
038237ca363023148ebf3e916a41d6f3d9dd7e1e

SHA256
7adbbe1a61f8b059f6edb7ca499876b6cde76c46cce2bba7fe59ddfcca15a719

SHA512
9136b9824ed13f049994677ef10bc922be7dfef02dce4d01b526e25673548553ba116e36887c2df640e54f16e79015caf9a453f97e8845572f74c7d5ce9540cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_th.dll

Filesize
28KB

MD5
f6d4a9340f35c0e90585607e1c7c0d45

SHA1
c6797a8a1aefae5a84dbcdc5ec82659a7af59ad1

SHA256
605385537fa3c286cc1ee39acab15f2c891c939b0596eae8a3003c799b7af180

SHA512
12d0b20b8f77bf8e73bd36e870cf55333f24002544cee868b940048d387a3cc66636ba043e716d15c85b17b1bc90ac711691a425edce0db39314b20a559a6459

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_uk.dll

Filesize
28KB

MD5
b060fc0728ecc79def8237908a3546f8

SHA1
076205bb3761eac18844abefd9d1f9c53d4a4b62

SHA256
21e09de2e671f6f76b95fba26addaae2170de6cb3a8ff4ee140a5d8743317d59

SHA512
9b8d04786fb495046348f08784fcda15c23211167a39f675e9bec7c7b33a54dd585bd4e23f4cdc2bd5378374c1ae676f2de57a8d7c8e52f9d5b12824cb6bbe4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_zh-CN.dll

Filesize
22KB

MD5
9fa942236aed9c4ed48591f49c2cc2b9

SHA1
41b3be3c3c23552b82bc19e2b2593f6d7bdaa24c

SHA256
379f3220941cba8c52361930753b626c1aeeb066aad9019d175089a59d2bc96a

SHA512
849728cd91d168ae1d995c951ff696a8a2b398feb3d804214669c8edcd495605a313ffc261b3b90dc3a360554d69382bcc90499482d5c32170ee32861e4f085e

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\goopdateres_zh-TW.dll

Filesize
22KB

MD5
cd16020949df2440f9db12ddd08f0743

SHA1
fb66a9374fe15410b2e7341c99e5379ea8e16985

SHA256
7982208d93e54a9ba8e354e31339a4c859474cf15c4b7f5b0671f7ba013075f1

SHA512
f5b1667f14fbe9d34a9c0276637da46f4e57641e03a9d43ce68b900a5de40444826005075635aa824a3e1d85cbef8699a5bdc98d6b94a29daaedeac4bd47aae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\npDropboxUpdate3.dll

Filesize
271KB

MD5
056e2769cfbd90ec3d563149765cfbe1

SHA1
58f4a9a02cc6a610572e2009f70aad5b67b8979b

SHA256
05da7b9b54cb548f7602b0bb25427ff184566c6500d744d83a5d0aed295afba4

SHA512
59b94b837136e2f63a17816eeff9e0ddd71b8e9b4dcd2409d33e0616541fcb34a1d4de4b211c0f0aa1fc5e55c7d212691453ccea92c3f1da5693ff1c97e0001a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\psmachine.dll

Filesize
208KB

MD5
d825ef26b12d392b35ccc41103fa23f2

SHA1
c700ce7960211ae371bcd44547c48455b3226aa1

SHA256
71daebbcbd0883090a75a7979d0ab37ac1e112eb6b93d9fdf3d590b82de30385

SHA512
cd92edbc4166ad03aa01fed14218c7d83f8c24fb147e6cbe8ed9b0987900a38cfd5fe40985f7e8396fb65e48212d1787a2e933856ded9f785bd94b96133858db

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM3112.tmp\psuser.dll

Filesize
208KB

MD5
295663f7da8aa06ca54af36293534d71

SHA1
47826420cfd53cda510227f19cc355a821feb935

SHA256
11dccd11b7acc5e66e084a7cc2c50d25365719525ba66a341a59fc9183fa82af

SHA512
6b1c74e886644c5b76350c0e418beda40104c9e96e4dd45c0bd6015fdde9565447fdcb734c7d00d88ab5335f6276c4ce40c1c38f4ac9a3883d97a80b9e7719c3

Download Submit
C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

Filesize
924B

MD5
fb2027d64436b4d99427bf17ab33b994

SHA1
5499762f52ba346b40d26b480f4afdf1c592086a

SHA256
94c60b65654529c63b2412cd22ca708dffb338f524895eecb226a57f1c900c96

SHA512
618b71fd242070164684ad49d81750c00db3a958c28337972d4dd5e304bbf28337a9b4db1b5c5cf0479cc3f8f998a767ca14237dd8ee38a32e89e8162d0d8ea0

Download Submit
memory/4716-38-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download