1d47018f66ef2fea056de45f0a27195b1c6abe985b0104640f96b6ef8e0e0f35

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_22cc6ba18cc42f168e2732a935a049b9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 632KB
Sample260416-tkahkshv3w
SHA256 1d47018f66ef2fea056de45f0a27195b1c6abe985b0104640f96b6ef8e0e0f35
MD5 22cc6ba18cc42f168e2732a935a049b9
SHA1 6c40f74540d1084f526d85591864cde8b8704894
SHA512 f863afeaddabb1249e1e36ccf5ed60a692c450e6f09af21ddf69066ecca19ef3e02dd33d282d01581e33587a1027f4e5c7e5c05253cbe87732415b45b3b1bdeb
SSDEEP 12288:q/iSuokQiMXBLfzYjnlJE1xl444clzKbtDf4TclbwO0dJYPjfWrhrn:q/iUbVKnHEva4plzKxT4TclEO0yjM7
TLSH
T198D401D4E1B44CA2F5F31E7940A895724AFFB84DF571818E1A81498C0A73ED3DE297E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe

Executes dropped EXE 11 IoCs

pid	Process
4396	DropboxUpdate.exe
4836	DropboxUpdate.exe
3376	DropboxUpdate.exe
2208	DropboxUpdate.exe
5596	DropboxUpdate.exe
5008	DropboxUpdate.exe
6136	DropboxUpdate.exe
2712	DropboxUpdate.exe
4848	DropboxUpdate.exe
4196	DropboxUpdate.exe
4364	DropboxUpdate.exe

Loads dropped DLL 21 IoCs

pid	Process
4396	DropboxUpdate.exe
4836	DropboxUpdate.exe
3376	DropboxUpdate.exe
2208	DropboxUpdate.exe
5596	DropboxUpdate.exe
5596	DropboxUpdate.exe
5596	DropboxUpdate.exe
5596	DropboxUpdate.exe
4396	DropboxUpdate.exe
5008	DropboxUpdate.exe
6136	DropboxUpdate.exe
2712	DropboxUpdate.exe
2712	DropboxUpdate.exe
6136	DropboxUpdate.exe
4848	DropboxUpdate.exe
4396	DropboxUpdate.exe
4196	DropboxUpdate.exe
4196	DropboxUpdate.exe
4196	DropboxUpdate.exe
4196	DropboxUpdate.exe
4364	DropboxUpdate.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1688	msiexec.exe
6	1688	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DropboxUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DropboxUpdate.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation	DropboxUpdate.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	DropboxUpdate.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_da.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_en.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_uk.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ko.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_no.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_zh-TW.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxCrashHandler.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pt-BR.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_es-419.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ja.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_nl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ru.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_sv.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\psmachine.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdate.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_it.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_th.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\npDropboxUpdate3.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateHelper.msi	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateBroker.exe	DropboxUpdate.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_fr.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_ms.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_es.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_zh-CN.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.503.1\psuser.dll	DropboxUpdate.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File created	C:\Windows\Installer\e580a9e.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA19B.tmp	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File created	C:\Windows\Installer\e580a9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e580a9a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_22cc6ba18cc42f168e2732a935a049b9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5008	DropboxUpdate.exe
4848	DropboxUpdate.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	DropboxUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\ = "ICurrentState"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ = "IApp"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\NumMethods	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CLSID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\Elevation	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer\ = "DropboxUpdate.ProcessLauncher.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CurVer\ = "DropboxUpdate.CoCreateAsync.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\CLSID\ = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Net\1 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.503.1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ProxyStubClsid32\ = "{E18222D8-898D-495F-9D20-460324C7271E}"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0\CLSID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E18222D8-898D-495F-9D20-460324C7271E}\InProcServer32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\ = "Dropbox Update Broker Class Factory"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ = "CoCreateAsync"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\ = "IAppVersion"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\ProgID\ = "DropboxUpdate.CredentialDialogMachine.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID\ = "DropboxUpdate.CredentialDialogMachine"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96D1EED3-701E-4FE5-B996-A543A8465897}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\CurVer	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ = "IAppVersionWeb"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\NumMethods\ = "24"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ = "IOneClickProcessLauncher"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CLSID\ = "{96D1EED3-701E-4FE5-B996-A543A8465897}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer\ = "DropboxUpdate.CoreMachineClass.1"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\VersionIndependentProgID\ = "DropboxUpdate.Update3WebSvc"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CurVer	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96D1EED3-701E-4FE5-B996-A543A8465897}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CurVer\ = "DropboxUpdate.Update3WebSvc.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
1688	msiexec.exe
1688	msiexec.exe
4848	DropboxUpdate.exe
4848	DropboxUpdate.exe
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
4396	DropboxUpdate.exe
1688	msiexec.exe
1688	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	DropboxUpdate.exe
Token: SeShutdownPrivilege	4396	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	4396	DropboxUpdate.exe
Token: SeSecurityPrivilege	1688	msiexec.exe
Token: SeCreateTokenPrivilege	4396	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	4396	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	4396	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	4396	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	4396	DropboxUpdate.exe
Token: SeTcbPrivilege	4396	DropboxUpdate.exe
Token: SeSecurityPrivilege	4396	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	4396	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	4396	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	4396	DropboxUpdate.exe
Token: SeSystemtimePrivilege	4396	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	4396	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	4396	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	4396	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	4396	DropboxUpdate.exe
Token: SeBackupPrivilege	4396	DropboxUpdate.exe
Token: SeRestorePrivilege	4396	DropboxUpdate.exe
Token: SeShutdownPrivilege	4396	DropboxUpdate.exe
Token: SeDebugPrivilege	4396	DropboxUpdate.exe
Token: SeAuditPrivilege	4396	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	4396	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	4396	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	4396	DropboxUpdate.exe
Token: SeUndockPrivilege	4396	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	4396	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	4396	DropboxUpdate.exe
Token: SeManageVolumePrivilege	4396	DropboxUpdate.exe
Token: SeImpersonatePrivilege	4396	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	4396	DropboxUpdate.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4396	4148	2026-04-16_22cc6ba18cc42f168e2732a935a049b9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	85
PID 4396 wrote to memory of 4836	4396	DropboxUpdate.exe	86
PID 4396 wrote to memory of 5596	4396	DropboxUpdate.exe	93
PID 4396 wrote to memory of 5008	4396	DropboxUpdate.exe	94
PID 4396 wrote to memory of 6136	4396	DropboxUpdate.exe	95
PID 2712 wrote to memory of 4848	2712	DropboxUpdate.exe	97
PID 4396 wrote to memory of 4196	4396	DropboxUpdate.exe	107
PID 4396 wrote to memory of 4364	4396	DropboxUpdate.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-04-16_22cc6ba18cc42f168e2732a935a049b9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_22cc6ba18cc42f168e2732a935a049b9_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiZUp5clZpcE9MUzdPek0tTHoweFJzbEl3TkRNek16VTFzN0F3TVRBM3REQXhBcEpteGdZR0ZpWVdwdVltaG1ZbVJwWUc1a1ltbHJVQXFpOE54UX5-QE1FVEEifQ"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Indicator Removal: Clear Persistence
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4836
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:5596
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVpVcDVjbFpwY0U5TVV6ZFBlazB0VEhvd2VGSnpiRWwzVGtSTmVrMTZWVEZ6TjBGM1RWUkJNM1JFUVhoQmNFcHRlR2RaUjBacFdWZHdkVmx0YUcxWmJWSndXVWMxYTFsdGJISlZRWEZwT0U1NFVYNS1RRTFGVkVFaWZRIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0NDRDgwQTYtMjUxNi00MDdCLUE0NjYtM0VGMzAzNkRGNzAxfSIgdXNlcmlkPSJ7Rjg4QzBDMTYtM0Q2Mi00QjlFLThFQzUtNEU0NDc1Q0Y1RUI4fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezBDRjYxM0JBLTM1REItNDY3MC1BMDc3LUQ3MDM3RDk1NDYxOH0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5008
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiZUp5clZpcE9MUzdPek0tTHoweFJzbEl3TkRNek16VTFzN0F3TVRBM3REQXhBcEpteGdZR0ZpWVdwdVltaG1ZbVJwWUc1a1ltbHJVQXFpOE54UX5-QE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{CCCD80A6-2516-407B-A466-3EF3036DF701}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6136
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdate.exe" /unregsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4364

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3376

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2208

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
  "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVpVcDVjbFpwY0U5TVV6ZFBlazB0VEhvd2VGSnpiRWwzVGtSTmVrMTZWVEZ6TjBGM1RWUkJNM1JFUVhoQmNFcHRlR2RaUjBacFdWZHdkVmx0YUcxWmJWSndXVWMxYTFsdGJISlZRWEZwT0U1NFVYNS1RRTFGVkVFaUxDSnlaWEYxWlhOMFgzTmxjWFZsYm1ObElqb3dmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjUwMy4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0NDQ0Q4MEE2LTI1MTYtNDA3Qi1BNDY2LTNFRjMwMzZERjcwMX0iIHVzZXJpZD0ie0Y4OEMwQzE2LTNENjItNEI5RS04RUM1LTRFNDQ3NUNGNUVCOH0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins4MTIzNzM1My0wQTEyLTQwOTEtQjQ2Ny04QTIzRjI0ODU3OTB9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4yIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4NzkiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e580a9d.rbs

Path C:\Config.Msi\e580a9d.rbs
Size 7KB
SHA256 a131fe6f4dea8160ee16ec395cfad684593323d96ed79e77f73b10f604194ca5
MD5 ec4521679d73290248d2dfe3860d19bf
SHA1 bd58523983a8bd0464124201a3cec420d90fc7af
SHA512 7d408442acbac7f0cea4d0f27e5c880ce544586c210061bb5ecce67984d93c51124ab6a9c22950de2314f777aa4ec0c5ded9668cb097a59b8236fe33b510542b
SSDEEP 96:aQwynReiI3XUxlCsThqC4UxlC6jeKTq+EThq4HNY5HVWM1CVCCsljeKn12y:aqeXExYI5xYxKsIPxCsIK1
TLSH
T188F10F41B640C2E2E8EB1B7CD71317523BB3D7C9A341534B08CD81368F9778A6E5E29A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e580aa1.rbs

Path C:\Config.Msi\e580aa1.rbs
Size 7KB
SHA256 70dd67683c5e4637dce9ac19cb398df6e75e65663a8fe5bf3a05463070eb7556
MD5 28de0cd265776139a3aecaa300a67595
SHA1 6537db2f524d01c56138de05f5af7972c6ac861a
SHA512 f9d73d6cb074354247bbe5ed9424f4900573578b128abb6850c04d5c4cbdc2e42e3a5a84611dc1c5b265d498eb14f9bbc8f7c1f7f378c4a2cac95fc1ed40bb34
SSDEEP 96:fslY+Y8RK3Ix4D8RB3ICjewC8q+c+14JIvIdjewbpr59opdyia:f4ReIDR1IZOv1SW+
TLSH
T1F3E11201A240C2E2FDEA1F3DD72317613BE3D7C9A309434700CD55728B5A7896EAE296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateHelper.msi

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\DropboxUpdateHelper.msi
Size 24KB
SHA256 6c056b84dd5d6804bfc05bf502d3d81bf7fcc21c3006b7f35e8dc0e1314b80af
MD5 2dd73adac0d93b3257fd3eb307d51979
SHA1 c8d5061924e3631a15be9d57efb4894d48c0f72e
SHA512 5aa1136008391ef94c36ba9405265961245b07021cdd80c089fa3887e441d38545588434f4f9959d84b736882c20f209a6d2ae8d3797639da7bc4c388ed9b3f2
SSDEEP 384:Px5Pey3M5IC0ioXvsSkAo9DGs2hmYoXNXYpktL43r:veWMmCEsTDGfh92dYpU0
TLSH
T180B21917B6005632E8065F3125AAC3A59B317D44AF978463729BF39C2FB2BC135BD2E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fr.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_fr.dll
Size 31KB
SHA256 841ac06920dbec0479a646acdb425f0de8a3dc718deb8b89d6db9d3fcf5127b2
MD5 2c565a0a286d04a01ebc7d6b730a1abe
SHA1 6685d0a15180cf1a0e15859a0d06952581d28a37
SHA512 067148dc7e7c2914ed66069033c2b545002f89d8a85ee8f54e3894f6991bc32a5ff7eb25d1f8f1ec996bea99da3b2b6b7d5e48e2132c4d765c212aa5b8ba1d8b
SSDEEP 384:ZRq9XpDshgWIPuEQCtx/dPtF0IK9qMhGXDGsXhXZ:i9XNZWI6CtVdPts9wXDGIhJ
TLSH
T10AE2D85297E81A01F6FB7F31B8B981104E3ABC9A9D35C52D2240E49D1D31B51EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_it.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_it.dll
Size 30KB
SHA256 862ba228fe81ef95d30c43331bb7be769c77ea463d4ef05dccc6dd772e1474b9
MD5 bea99abe5ad6d5c8520915039a91aced
SHA1 1a3d1dda5c3eed9aa084c704cde4911d111f5cf1
SHA512 90db87e50536d9fd8d0ea393898e05984197ef020feb6a2ecd5efc61b95094cbab42dc42e6485e984d46c15642cba6839f9a27fa5e68f40d6e06f7420c76fe69
SSDEEP 384:8YsY9XpDshgWIPuEQCvO6Qr0mhz48sxDGstyhw:iY9XNZWI6Cvcr0mhzIxDGthw
TLSH
T109D2510197F81A04F6F77F30B83896294D36FD52AD39C62E2241D46C5932A92EDB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pt-BR.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_pt-BR.dll
Size 29KB
SHA256 2758ba08f78ba798d25a2e68ad3f9a13a3274a9a7a33422d165570a14b50fb6e
MD5 487df036e56a8fe0831a562e8ca0f612
SHA1 09b544c47d1b21bf53d6fb164a309941020783df
SHA512 049a5346870a341ac7f26f95e955801d535d4f483e96709e8e26c645e1a20a066d2676b73425a4c16864040f6f81f043dc1c3c8230b321350fdceca11510cb88
SSDEEP 384:oM99XpDshgWIPuEQC0qIlFEZnK+J1K1DGs2hiq/:z9XNZWI6C0rnEZHQ1DGxhl
TLSH
T1C4D24E4187F81A44F6FB7F31647456258D33BD62ED38C66D221090291E71B82EEB8B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_th.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_th.dll
Size 28KB
SHA256 605385537fa3c286cc1ee39acab15f2c891c939b0596eae8a3003c799b7af180
MD5 f6d4a9340f35c0e90585607e1c7c0d45
SHA1 c6797a8a1aefae5a84dbcdc5ec82659a7af59ad1
SHA512 12d0b20b8f77bf8e73bd36e870cf55333f24002544cee868b940048d387a3cc66636ba043e716d15c85b17b1bc90ac711691a425edce0db39314b20a559a6459
SSDEEP 384:eP2RY9XpDshgWIPuEQC7poRUkGGqqDpaaLxo21DGsvFhih:LY9XNZWI6C7+RUkGGq2aaLxo21DGWhW
TLSH
T149D2A47482B12B02D56BC8B0E1C48E737C2CED21DD1AC1A5B06FDD345A316B2ABF995D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_zh-CN.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\goopdateres_zh-CN.dll
Size 22KB
SHA256 379f3220941cba8c52361930753b626c1aeeb066aad9019d175089a59d2bc96a
MD5 9fa942236aed9c4ed48591f49c2cc2b9
SHA1 41b3be3c3c23552b82bc19e2b2593f6d7bdaa24c
SHA512 849728cd91d168ae1d995c951ff696a8a2b398feb3d804214669c8edcd495605a313ffc261b3b90dc3a360554d69382bcc90499482d5c32170ee32861e4f085e
SSDEEP 384:GW39XpDshgWIPuEQCcPRKPBDGsnKUhDKw:F9XNZWI6CcJKPBDGnUhDKw
TLSH
T1F8A21A0647D01C41F77E9D31A088D6269632FD22AE45857B3144F4361EB2B83EF7AB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psmachine.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.503.1\psmachine.dll
Size 208KB
SHA256 71daebbcbd0883090a75a7979d0ab37ac1e112eb6b93d9fdf3d590b82de30385
MD5 d825ef26b12d392b35ccc41103fa23f2
SHA1 c700ce7960211ae371bcd44547c48455b3226aa1
SHA512 cd92edbc4166ad03aa01fed14218c7d83f8c24fb147e6cbe8ed9b0987900a38cfd5fe40985f7e8396fb65e48212d1787a2e933856ded9f785bd94b96133858db
SSDEEP 3072:U4nPvkwaGLWtiSSztEbQ9VPfPGyam4lblK7QXrQrsMU+ghzQWD+a:UacfiSSBEbwVPfeyzacsXksM5a
TLSH
T1A3248C1172D0C036D66F103944ABC7626BB97D306FA4C58B3B94BA6D5E70782EB36393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
Size 400B
SHA256 e9a1f7d0194a1150b139617358a5d38cf364c3141aa293c318a6baa6e567ad50
MD5 b6ce561ba032d67b65bab87230c9a950
SHA1 34b579820dd2ffad41fe999c0bbae4dbedebbca4
SHA512 70ffb0af93522a3c69b524c4a1b60f888d331729434b6214912f8aa9c85614bc5429cfae953702f4ea63694bbbbced98b4f79f785b6f7ab8de04378b179f69e0
TLSH
T104E0C02437E6012CE174AA74C2E596B94B2DE2110840C77202A408063E03342ED31A30
MD5 SHA1 SHA512 TLSH

Submit Download

DropboxCrashHandler.exe

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxCrashHandler.exe
Size 126KB
SHA256 b6f2afd4a5442c197959162f657cdb22b640adb0d4ee261e1186ddc8c55ef815
MD5 b108281fad84939c0f85d5e666ab0814
SHA1 0390a0e31922f1c6e318d6c4fe774e7ac61837eb
SHA512 c28686077a380e584ed472715ae8e2bd5c8b6f3acfe17767a3dceabdadcb42f0f1c24a2a145631f1aac5289044e06754a0937d44f922e780977fcc94f31637f1
SSDEEP 3072:jZOOxLE4GTnicyr2QbDfW+Q4/SsuTyhvXJpTAmT5xyb4YcC:UOxLEbTSdlC
TLSH
T1E3C3C5C1F6B84CB9F4F359391429867295BFB83DF922864E2994019D0E23DC38E257E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdate.exe
Size 126KB
SHA256 e720b05e5bc033c8cd48be3d88bf29af9ba51eeed489d6ef23d64f8b99d5648c
MD5 e67aab913a3b8365c1fa336ec86edd0f
SHA1 decee6e1704d9bef26841c39e60abc88850f770c
SHA512 72dede9036d3e921cd5395b3c31c6375a36a05c8a5006b3fe134002959ad3bcdd87eedee3f40afa673700529d00ccf4ac3d07c39c2780cead4dd3e3f90a207c2
SSDEEP 3072:lZOOxLE4GTnHcyK2QbDfWb0UTmwiXWR/zdt/UqPBNy7MzcI0t:WOxLEbTBAhI0t
TLSH
T130C3C5C1F6B84CB9F4F359395429867295BFB83CF922864E2994019D0E23DC38E257E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdateBroker.exe
Size 73KB
SHA256 4df6688660df75e4dd667d0f29b3ab6f24aa96b4d551b9570f9717cf26cc2f63
MD5 bf2caffebc9cce469b835db5727a28a4
SHA1 2b33955db3cd40d48868d55d6144b27f86d50e82
SHA512 f1ae1f4d43d3e97716b8a637eee39b8a508ecb124ec466a3ab883d6e11c39731611efc56ee500e1cd2cc45aa503b46242b251eed6779deac8f32c1a677c4f033
SSDEEP 768:m3bwKvIIfEr5EJFQp18EMUpVP2x6lTxSXBNQF4hPDfWd6ALDG3hp:m3bwk6WQfAUDPbgQGhPDfWMJ
TLSH
T1A773C2D1E4708CF2F0F35C7C206C96726AEFB51DF6A08056265852AD4F63EC35E292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateOnDemand.exe

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\DropboxUpdateOnDemand.exe
Size 73KB
SHA256 948dddfad908582eb397862d377d2c25de3a04b561fb8ac041f8397c51ac65aa
MD5 0304e8b49fb0ec5c3d44346c19cbabdc
SHA1 fc9dcacbe95ed627d3785579d7b1b1b278b6fdf9
SHA512 a29c6fb19fc066d7623761be2f98bc566a5483e25c6273aa50647e826dd464a89fa498cbeb8393a42011d8897fed712a222d83cfaab5a4ef0420e1548965cf7d
SSDEEP 768:4/b4KvIIfEr5EJFQp18EMUpVP2q6lXxSXBNQG4hPDfWd6AyDG1+hO:4/b4k6WQfAUDPsEQlhPDfWMc
TLSH
T16973C2D1E4708CF2F0F35D7C206C96726AEFB51DF6A08056369852AD4B63EC35D292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdate.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdate.dll
Size 1.1MB
SHA256 f949cc14b2457acc381a97c158e468b581658e779585cc87a8b9f6c250123f24
MD5 ae63fca47832957cfe612c182f160431
SHA1 472a270e83bec3551c6d65d2e81fe653c819849d
SHA512 15d8e801f23a1bdd7c97ababc40edaaf01803f3e1a97c2f3a02f2d180f1aa8faa0bb3cc69d797456260c100e0890a734784f0495c3175eaf49c05c2ffa6e4c5c
SSDEEP 24576:S0HyEltbQzVan6mT4cBOvxt5bzs2KECwoe2/g81VNDMa:tHyEltb2M6Pv3RNiwoxg81VOa
TLSH
T1C9352A9237E18871F8FB0A79E976DA35BA7B7961F934C40E4380844F6973682DC26713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_da.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_da.dll
Size 29KB
SHA256 78426a78f89135d8ee9f924e366737afaf2eb2c0c82c7c18c496bc763e42cc78
MD5 7352b8c512b95545d2289ab35fa74f6e
SHA1 62e362927c55a2e8259ade7b0ca6922109073dbf
SHA512 4e65e3137a794425271a4c1b33b6064329727c8c9da46bb74c04a6f2d9387ee897368b566e10c01c68d46aa2e251f84c11c9af03dd5d2aef4d1b401cab4574fc
SSDEEP 384:ZeM9XpDshgWIPuEQC2uRL51kw9J+pDGs2iho5hk:L9XNZWI6C2WV+pDG6hqO
TLSH
T1FFD2415257F85A18F6F76F30BCB982504975FC92AE38C62D3244A06C0D72785EAB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_de.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_de.dll
Size 32KB
SHA256 62bfbbf544d3420fb9dbeb48b2aa78702e42925e68f880096fcca52897bbf09c
MD5 339ab3d963f4d9b2c13e48ed045dbb5b
SHA1 faf05f2713bac43be1449681df2dc0ebae7c6c86
SHA512 dee5fbe1270e562ff12d11e152053f3f0acabeb6233edb4d2d4672c684627c33a034a412302fc311c2aaaba219c43cdf9b420731b13b0126e7b2eb6a857e1036
SSDEEP 384:uEL9XpDshgWIPuEQCx6q+1KfK9Y3uLS/DGsHh9:r9XNZWI6Cxv+1KfK9Yp/DGuh9
TLSH
T10CE2FD4147E85908F2F76F30BD7892655E72FC92AE75D92E3300A06C1871B45EAB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_en.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_en.dll
Size 28KB
SHA256 b0100feacf0d4a6b83c9a69ae80c050d59f277b2748e86e421607113bd3869ec
MD5 743d35e1766c961cca9364fb6743110b
SHA1 516f884ae7027d4f21ea03b4887b187ef9d13495
SHA512 a7ed4f6c0e8149cbf54f49b261afaa1a49dd9c1ba0959e144f5cfedf91b99c49c200af23c4bc04fb767769664c6c03e67dbbf255d9e60226f93feaa4952389db
SSDEEP 384:cBFg9XpDshgWIPuEQCSUdagyyyR6SDGslpyhj0:l9XNZWI6CSIagyyS9DGlhj0
TLSH
T18AD22D4287F41914F6FB6F30B9B495214E35BC52AE38C66D3240D42D5972B82EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es-419.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_es-419.dll
Size 30KB
SHA256 d4dfa2db01c7d54c373974aa60f1979604c96e5f972eb58783f64a8dc5f40ab9
MD5 60ee4ba1c43e52744c42921bd977f83c
SHA1 a4332ccbeebeb41c4a0e5ff96a8c72213b5d60db
SHA512 98a57bcbfde233a9dbf69043df190d4042c8ceab0a0f0b9d6a1727b8c7a3264d5378ba88ee922f7232d86a489f62e0c98e9915c3513fd6c5ae437c040c697e22
SSDEEP 384:yfcC9XpDshgWIPuEQCXHAU/yedYDGs9hj/:yd9XNZWI6CXHl/lYDGChz
TLSH
T111D2EA004BF85A46F6F77F30A87856258E3ABC92AC39D51D2210A52D0D71F85EE78B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_es.dll
Size 29KB
SHA256 b518c890a9470a10a2d249b331b36e35f7908895d405901c1fc2143529e5053a
MD5 d2b84c50183add60407bb9b265d62b7b
SHA1 7889bf24cd6c60b4d0018bdf09241d50caaf5535
SHA512 1f5157cf788229ed4a63d0201b5cdf4d3027492a766d83f2f7bc8eaf74643db749c2e64b9cfc93e049c862de566de8c1212f1af57c2eb009a509b34673d67864
SSDEEP 384:3sC9XpDshgWIPuEQCjzDxLLWS27HDGsbhn2:19XNZWI6CjzFL/27HDGQh2
TLSH
T176D21D108BF92A46F6F76F34B87455254E3ABDA2AC38C55D2210912D0D71F81EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_id.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_id.dll
Size 28KB
SHA256 9f58ff7ee99951136488d7a068f93f354ae1c0fe2d241f5797ea446b1e5ec6d3
MD5 e22219dd76a58c9519272dbe9732feb5
SHA1 4698d37ae511a4310b3c4e974d8ca695bebd0fc2
SHA512 b7ba3f0361ffb71da568e75553ecfcb21fd1f5d1d3411e442acddad69dc52e47f95e17c84e38642f68ca4ed993dd6789213e8636061699aabf6b2284b52ab427
SSDEEP 384:FxtR9XpDshgWIPuEQCt+THDWq6elDoWoRncvCPHlUhHDGshhaP:/9XNZWI6CtibEvuhHDGmhaP
TLSH
T128D22D9143E86948FAFB4F3065B496550A37FD63BE34822D3244A5285D72BC2DE38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ja.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_ja.dll
Size 24KB
SHA256 1d783a15befc72b76ac3ca077c1fd9645462a42a9d06cf2b47c06eedc8ff3a84
MD5 39be5c1e2b0c2c8b339dd0a57fdac041
SHA1 d7a58c18a02643d3cdab6e73a161f4bbf9f4bcd9
SHA512 2f1e74dde409d2ede51e60ba5524066a2185e2fefdfba733b36ddca12720854eb2656adcc980ad84c517a47fc00aac24223785766bc47a2c6ee1a2fb72207bf7
SSDEEP 384:Ij59XpDshgWIPuEQC1MI9uttlSa/9s3DGsYith+:g9XNZWI6C1RyO3DGZith+
TLSH
T1C7B21A4557E04C4AF9FACE319090E5295A34FC32AED18D723040E41A5DB1BC79B6BBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ko.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_ko.dll
Size 24KB
SHA256 66f5a74c03fc8ad4d582c6cf4f6972cb851efe62a1bc520af09274dfd3d59b1c
MD5 91beea2d8f6c24517cd77742427f08ab
SHA1 76b3df167e153574bdaaf5876cde206c02d411d1
SHA512 d5271f7c31f4de8d66a4c216d9b2587f54d0ba2ecb8928c8d776dc1c264e2e82dbb8e5e5f2b2425b964560e6d6f01cb35d9b65664f2c2cd83c84d0d609d283a1
SSDEEP 384:T1W9XpDshgWIPuEQCCZeEFzcZhvt01ANY+UslmzkB3rXmNZYB5HhYKWvk/kDGs/x:c9XNZWI6CCYecZDPkWfB/kDGah/
TLSH
T178B2F80282A4A801F9B9DD3160C0DB665235ED21AE1B8527F780F1786E727C2EB797DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ms.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_ms.dll
Size 28KB
SHA256 f6ed38bf762df998589f17d6f7293d347fad019b21990943f0e13346f7030097
MD5 dc3d2532e16bd742cd405d4336222c40
SHA1 aa8e9e9531746b7b6940267113f7c78f6355b632
SHA512 ce5581d3da5e6c78bc867ec1d9ec6ff6bf8b95626ae1b4b1128cc5db1d7247bf212f2dc9b740b5b6c602ba609fd25752db6affd1a02de79885a65cec63c9454c
SSDEEP 384:/tW9XpDshgWIPuEQCeLRYV7ZZgZuG3yK6jFJHgcO/2WfdqJBAQCRNrDGsS+h7:o9XNZWI6Ce2qDzNDGn+h7
TLSH
T146D20B9143DC6948FEFB8F3065F456514A27FD53BE39822D6344A4284D32AC2DE38B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_nl.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_nl.dll
Size 30KB
SHA256 31863bfe9cfa56314c16c124854c8b6c2dde44da9986015a1829c22b1340398e
MD5 ea2e2791a966eda8ec1416b28824ce93
SHA1 f39dfb95a88c60d58edcf73a3172f500d92208f2
SHA512 525605ecae61307a2f6d5ea57062ec0b08b54a7aa0b5a2abb993446b201f342af5fe39d2c73b81c6544a04908fecd3bfcf5ad0f4c831d7cc33cae3b58740393e
SSDEEP 384:ax2o9XpDshgWIPuEQCKn4BYUEz8BxU0DGs9hwM5+7:9o9XNZWI6CKxlQE0DGkhq
TLSH
T11FE2D94257F84918F6F76F30BDB885618E36FC92AD34C66D2240A56C5C31681EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_no.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_no.dll
Size 29KB
SHA256 ca2b32de1a864b069196d3b4e6734ed7bc80dd29907b1bd717d658cc2ac60c41
MD5 ed6410ab442d7e5337c97aa2c65d3232
SHA1 063bfa594b9abf54af2fec7c106cb2aae07f1bbc
SHA512 e5034db1a4d6d656dc2c63daea969fff857e9c7cffe4500d8d8052d4aee4fad703527d94c62deac4680d94721d4ad7ddabda21ce1f38e5ab8adee11ea18a40c5
SSDEEP 384:l2/q6Kaq6Kaq6Kaf19XpDshgWIPuEQCDKH/IGDMsiKVjDGsghN:+9XNZWI6CDKtDviKVjDGXhN
TLSH
T1E6D2515197F44919F1FB6F30BCB845254975FCA2AE38C61D3244A16D0D327C2EAB8B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pl.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_pl.dll
Size 30KB
SHA256 e0b061b34a859f45c8e322d1d454bff9e345a2969f3cf79ef26f91f3a53bf432
MD5 619d783f82f4074bd698e70cd7c0cb2a
SHA1 843942bb4a6f4fba47c727815f61271f7546d031
SHA512 51c64733021d6243a6ab8829d14c6ea93c0bb9d1c26720ca8c1885f1277bebf9d5b87978237c6efd0a74d7e0c7194b9195c3d56ffac06367b47c564182358f22
SSDEEP 384:VkA9XpDshgWIPuEQCqJlL7bHNzcjANLsMnt3DGs7UhJ:N9XNZWI6CqLTLZZDGbhJ
TLSH
T1E8D2340197F80541F6F7AF30B5B466658F3ABC22BE3581AF364091590A71AC2EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ru.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_ru.dll
Size 29KB
SHA256 7adbbe1a61f8b059f6edb7ca499876b6cde76c46cce2bba7fe59ddfcca15a719
MD5 8fd3deaadb1d1037f1fe5b46112a9653
SHA1 038237ca363023148ebf3e916a41d6f3d9dd7e1e
SHA512 9136b9824ed13f049994677ef10bc922be7dfef02dce4d01b526e25673548553ba116e36887c2df640e54f16e79015caf9a453f97e8845572f74c7d5ce9540cb
SSDEEP 384:guz9XpDshgWIPuEQCh44KN+5N+JnYOk3oyq3Lbq9DYNdDdHt/ym7DGsihDC:z9XNZWI6ChnjoyHZmnN7DGZhDC
TLSH
T11FD2540FEBBC9900F469D6701A6689E72024FF206B1A85A6718FFC70646477277397CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sv.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_sv.dll
Size 29KB
SHA256 14827356855850c7dad9e21616aa1e4432bff8c870eca557aa8d5060abecb740
MD5 94e6dfa058481bc79a2f69175ec5c332
SHA1 81aa442a9126783a6496c326307fa6294ae715e1
SHA512 7714842feb420f87bd11349e122b88d275842dee427d21e7f6b72cc4f8e337bf2d1f208983a714428bd4e020f93fe1b43adbab718182b6e4dc9d61fe116256fa
SSDEEP 384:hYl9XpDshgWIPuEQCTGVD3ciot2QQEJDGs0hU1:09XNZWI6CTIciotgEJDGdhk
TLSH
T18FD2644257E85918F6F75F30BCB486214875FC91AD79D62E3300E5AC0D31B86EAB4B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_uk.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_uk.dll
Size 28KB
SHA256 21e09de2e671f6f76b95fba26addaae2170de6cb3a8ff4ee140a5d8743317d59
MD5 b060fc0728ecc79def8237908a3546f8
SHA1 076205bb3761eac18844abefd9d1f9c53d4a4b62
SHA512 9b8d04786fb495046348f08784fcda15c23211167a39f675e9bec7c7b33a54dd585bd4e23f4cdc2bd5378374c1ae676f2de57a8d7c8e52f9d5b12824cb6bbe4a
SSDEEP 384:h4U9XpDshgWIPuEQCRbib0sS5kU40ryH5oHXmUzdkPhiDGsSJLhlHg:B9XNZWI6CR2voHSiDGXJLhlHg
TLSH
T179D2830FD6B84910F658D9315A92C6E71438FF206B98C6DA724FF830282977377296DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_zh-TW.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\goopdateres_zh-TW.dll
Size 22KB
SHA256 7982208d93e54a9ba8e354e31339a4c859474cf15c4b7f5b0671f7ba013075f1
MD5 cd16020949df2440f9db12ddd08f0743
SHA1 fb66a9374fe15410b2e7341c99e5379ea8e16985
SHA512 f5b1667f14fbe9d34a9c0276637da46f4e57641e03a9d43ce68b900a5de40444826005075635aa824a3e1d85cbef8699a5bdc98d6b94a29daaedeac4bd47aae0
SSDEEP 384:rHL9XpDshgWIPuEQCvJA6ql73inVv0WeDGs6Zhj:H9XNZWI6Cvul7nLDGLZhj
TLSH
T1CAA2180247D41C01F5AA9D32A0988536DA32FD226F15C57A3089F4755EB2B83EF3E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npDropboxUpdate3.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\npDropboxUpdate3.dll
Size 271KB
SHA256 05da7b9b54cb548f7602b0bb25427ff184566c6500d744d83a5d0aed295afba4
MD5 056e2769cfbd90ec3d563149765cfbe1
SHA1 58f4a9a02cc6a610572e2009f70aad5b67b8979b
SHA512 59b94b837136e2f63a17816eeff9e0ddd71b8e9b4dcd2409d33e0616541fcb34a1d4de4b211c0f0aa1fc5e55c7d212691453ccea92c3f1da5693ff1c97e0001a
SSDEEP 6144:tow9mNnZKeYfb0WUwytwVm9pWSTg2UC2zZrNDA:F9OKeYD0dwytwVm9e9ZhDA
TLSH
T1D144AE523BD08075F8B709349AE3DA526EBA7D315934C84FB7A8884CAF71B82D539317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psuser.dll

Path C:\Users\Admin\AppData\Local\Temp\GUM431.tmp\psuser.dll
Size 208KB
SHA256 11dccd11b7acc5e66e084a7cc2c50d25365719525ba66a341a59fc9183fa82af
MD5 295663f7da8aa06ca54af36293534d71
SHA1 47826420cfd53cda510227f19cc355a821feb935
SHA512 6b1c74e886644c5b76350c0e418beda40104c9e96e4dd45c0bd6015fdde9565447fdcb734c7d00d88ab5335f6276c4ce40c1c38f4ac9a3883d97a80b9e7719c3
SSDEEP 3072:H4n3PkwaGLWtiSSztEbQ9VPfPGyam4dr7K7QXrQAsMU+ghzQWN+d3:HqcfiSSBEbwVPfeyzymsXHsMvh
TLSH
T13C248C0172D0C036D66F103944ABC7626BB97D306FA4C58B7B94BAAD5E70782DB36393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateTaskMachineUA.job

Path C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
Size 924B
SHA256 97ddea4ae81a324d7f1b9ea54a9be197942d3492f0289a2f5e77e5d7f4b4ce08
MD5 be8aca252f4b320219a1f854bb267895
SHA1 4a9cc4221c68ad927227aaf1b08f7a4451f5a9f2
SHA512 cff158573860f638a66ac6ede10cceb9998ccd57d49cd6ba48345581e7c8d0e8861e6cbafedb25ab74b481edcc2e487d9b5d7948438e0dd181d224d36ef35759
TLSH
T1EE111351BBFA4124F6FB7F712BB05A95467BBC62BE30C64C1011054D9CB6A90C970B23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2208-291-0x0000000000550000-0x0000000000569000-memory.dmp

Download

memory/2208-290-0x0000000000800000-0x000000000087B000-memory.dmp

Download

memory/2712-367-0x0000000000F00000-0x0000000000F19000-memory.dmp

Download

memory/2712-366-0x0000000000DA0000-0x0000000000E1B000-memory.dmp

Download

memory/2712-401-0x0000000000DA0000-0x0000000000E1B000-memory.dmp

Download

memory/2712-402-0x0000000000F00000-0x0000000000F19000-memory.dmp

Download

memory/2712-403-0x0000000002930000-0x00000000029A4000-memory.dmp

Download

memory/2712-368-0x0000000002930000-0x00000000029A4000-memory.dmp

Download

memory/3376-286-0x00000000004E0000-0x000000000055B000-memory.dmp

Download

memory/3376-287-0x00000000005A0000-0x00000000005B9000-memory.dmp

Download

memory/4148-442-0x0000000000E90000-0x0000000000F0B000-memory.dmp

Download

memory/4148-359-0x0000000000E90000-0x0000000000F0B000-memory.dmp

Download

memory/4196-423-0x0000000000B80000-0x0000000000BFB000-memory.dmp

Download

memory/4196-424-0x0000000000C00000-0x0000000000C19000-memory.dmp

Download

memory/4364-434-0x0000000000BB0000-0x0000000000C2B000-memory.dmp

Download

memory/4364-435-0x00000000005E0000-0x00000000005F9000-memory.dmp

Download

memory/4396-36-0x00000000033C0000-0x00000000033C1000-memory.dmp

Download

memory/4396-360-0x0000000000C60000-0x0000000000CDB000-memory.dmp

Download

memory/4396-362-0x0000000003250000-0x00000000032C4000-memory.dmp

Download

memory/4396-361-0x0000000000CE0000-0x0000000000CF9000-memory.dmp

Download

memory/4396-438-0x0000000000C60000-0x0000000000CDB000-memory.dmp

Download

memory/4396-439-0x0000000000CE0000-0x0000000000CF9000-memory.dmp

Download

memory/4396-440-0x0000000003250000-0x00000000032C4000-memory.dmp

Download

memory/4836-263-0x0000000000510000-0x000000000058B000-memory.dmp

Download

memory/4836-264-0x0000000000590000-0x00000000005A9000-memory.dmp

Download

memory/4848-369-0x0000000001830000-0x00000000018AB000-memory.dmp

Download

memory/4848-397-0x0000000001830000-0x00000000018AB000-memory.dmp

Download

memory/4848-398-0x00000000019A0000-0x00000000019B9000-memory.dmp

Download

memory/4848-370-0x00000000019A0000-0x00000000019B9000-memory.dmp

Download

memory/5008-355-0x0000000000980000-0x0000000000999000-memory.dmp

Download

memory/5008-354-0x0000000000900000-0x000000000097B000-memory.dmp

Download

memory/5596-317-0x0000000001050000-0x0000000001069000-memory.dmp

Download

memory/5596-316-0x0000000000C90000-0x0000000000D0B000-memory.dmp

Download

memory/6136-410-0x00000000037E0000-0x0000000003854000-memory.dmp

Download

memory/6136-364-0x00000000015C0000-0x00000000015D9000-memory.dmp

Download

memory/6136-363-0x0000000001100000-0x000000000117B000-memory.dmp

Download

memory/6136-365-0x00000000037E0000-0x0000000003854000-memory.dmp

Download

memory/6136-408-0x0000000001100000-0x000000000117B000-memory.dmp

Download

memory/6136-409-0x00000000015C0000-0x00000000015D9000-memory.dmp

Download