Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 771KB
- Sample260723-xpff6shr4w
- SHA256 c55ebc481a6d075a1482fa525ec0ff26967314e57c39d5f7d5c586fd9e271aaf
- MD5 c39a6427eace884c16120f538ff0dffb
- SHA1 b4705a3b05eb7b8e823b0e2fe9b78cf521e344d2
- SHA512 fea1134e8bf02bcbeec4ae5732a6d6e3c405a03c69bf110f4eeac2f85ebda207c22dac884593f14848098e6427cc224356b3088ebc466907a4e6f39c49d316e4
- SSDEEP 12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
- TLSH T120F401C2C2B98CB5F4F71E7A58A885B109EFB85DF97489862345110D4A33ED3DE247E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0" DropboxUpdate.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation DropboxUpdate.exe - Executes dropped EXE 11 IoCs
pid Process 4704 DropboxUpdate.exe 3484 DropboxUpdate.exe 4832 DropboxUpdate.exe 2308 DropboxUpdate.exe 4068 DropboxUpdate.exe 3956 DropboxUpdate.exe 4044 DropboxUpdate.exe 5036 DropboxUpdate.exe 648 DropboxUpdate.exe 4776 DropboxUpdate.exe 1148 DropboxUpdate.exe - Loads dropped DLL 21 IoCs
pid Process 4704 DropboxUpdate.exe 3484 DropboxUpdate.exe 4832 DropboxUpdate.exe 2308 DropboxUpdate.exe 4068 DropboxUpdate.exe 4068 DropboxUpdate.exe 4068 DropboxUpdate.exe 4068 DropboxUpdate.exe 4704 DropboxUpdate.exe 3956 DropboxUpdate.exe 4044 DropboxUpdate.exe 5036 DropboxUpdate.exe 5036 DropboxUpdate.exe 4044 DropboxUpdate.exe 648 DropboxUpdate.exe 4704 DropboxUpdate.exe 4776 DropboxUpdate.exe 4776 DropboxUpdate.exe 4776 DropboxUpdate.exe 4776 DropboxUpdate.exe 1148 DropboxUpdate.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 5096 msiexec.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation DropboxUpdate.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_es-419.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxCrashHandler.exe 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateBroker.exe 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_da.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_fr.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-CN.dll DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\@PaxHeader 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_es.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_sv.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxCleanup.exe 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-TW.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ko.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_id.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_th.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateHelper.msi 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\psuser.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_zh-TW.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ko.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdate.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateOnDemand.exe 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ms.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_no.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ja.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\npDropboxUpdate3.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_it.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_en.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ms.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\psmachine.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_es-419.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_id.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_zh-CN.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pt-BR.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_uk.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\@PaxHeader 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_de.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_da.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_es.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_it.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\npDropboxUpdate3.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_en.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_pl.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ru.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_th.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_de.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_no.dll DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUTC.tmp 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdate.exe DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_nl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ru.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateHelper.msi DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ja.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_fr.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_sv.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateBroker.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_nl.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_pt-BR.dll 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_uk.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe DropboxUpdate.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94} msiexec.exe File opened for modification C:\Windows\Installer\MSIC4F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI72B.tmp msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job DropboxUpdate.exe File created C:\Windows\Installer\e580952.msi msiexec.exe File opened for modification C:\Windows\Installer\e580952.msi msiexec.exe File created C:\Windows\Installer\e580956.msi msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job DropboxUpdate.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3956 DropboxUpdate.exe 648 DropboxUpdate.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DropboxUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DropboxUpdate.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0\ = "DropboxUpdate Update3Web" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\ProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ = "IAppBundle" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\NumMethods\ = "13" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\Elevation DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ = "Update3COMClass" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CurVer DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\LocalServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0\CLSID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\ = "ICoCreateAsyncStatus" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\ = "Dropbox Update Legacy On Demand" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID\ = "{76E258F0-DE86-4CEC-9D30-3F728A898741}" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0\CLSID\ = "{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ = "IAppVersionWeb" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\ProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\NumMethods DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\NumMethods DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass.1\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\NumMethods\ = "9" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CurVer DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer\ = "DropboxUpdate.Update3WebMachine.1.0" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\ProgID\ = "DropboxUpdate.CoreMachineClass.1" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ = "IGoogleUpdate3" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\ProxyStubClsid32 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\VersionIndependentProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}" DropboxUpdate.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 5096 msiexec.exe 5096 msiexec.exe 648 DropboxUpdate.exe 648 DropboxUpdate.exe 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 4704 DropboxUpdate.exe 5096 msiexec.exe 5096 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4704 DropboxUpdate.exe Token: SeShutdownPrivilege 4704 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 4704 DropboxUpdate.exe Token: SeSecurityPrivilege 5096 msiexec.exe Token: SeCreateTokenPrivilege 4704 DropboxUpdate.exe Token: SeAssignPrimaryTokenPrivilege 4704 DropboxUpdate.exe Token: SeLockMemoryPrivilege 4704 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 4704 DropboxUpdate.exe Token: SeMachineAccountPrivilege 4704 DropboxUpdate.exe Token: SeTcbPrivilege 4704 DropboxUpdate.exe Token: SeSecurityPrivilege 4704 DropboxUpdate.exe Token: SeTakeOwnershipPrivilege 4704 DropboxUpdate.exe Token: SeLoadDriverPrivilege 4704 DropboxUpdate.exe Token: SeSystemProfilePrivilege 4704 DropboxUpdate.exe Token: SeSystemtimePrivilege 4704 DropboxUpdate.exe Token: SeProfSingleProcessPrivilege 4704 DropboxUpdate.exe Token: SeIncBasePriorityPrivilege 4704 DropboxUpdate.exe Token: SeCreatePagefilePrivilege 4704 DropboxUpdate.exe Token: SeCreatePermanentPrivilege 4704 DropboxUpdate.exe Token: SeBackupPrivilege 4704 DropboxUpdate.exe Token: SeRestorePrivilege 4704 DropboxUpdate.exe Token: SeShutdownPrivilege 4704 DropboxUpdate.exe Token: SeDebugPrivilege 4704 DropboxUpdate.exe Token: SeAuditPrivilege 4704 DropboxUpdate.exe Token: SeSystemEnvironmentPrivilege 4704 DropboxUpdate.exe Token: SeChangeNotifyPrivilege 4704 DropboxUpdate.exe Token: SeRemoteShutdownPrivilege 4704 DropboxUpdate.exe Token: SeUndockPrivilege 4704 DropboxUpdate.exe Token: SeSyncAgentPrivilege 4704 DropboxUpdate.exe Token: SeEnableDelegationPrivilege 4704 DropboxUpdate.exe Token: SeManageVolumePrivilege 4704 DropboxUpdate.exe Token: SeImpersonatePrivilege 4704 DropboxUpdate.exe Token: SeCreateGlobalPrivilege 4704 DropboxUpdate.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe Token: SeTakeOwnershipPrivilege 5096 msiexec.exe Token: SeRestorePrivilege 5096 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2472 wrote to memory of 4704 2472 2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe 86 PID 4704 wrote to memory of 3484 4704 DropboxUpdate.exe 87 PID 4704 wrote to memory of 4068 4704 DropboxUpdate.exe 94 PID 4704 wrote to memory of 3956 4704 DropboxUpdate.exe 95 PID 4704 wrote to memory of 4044 4704 DropboxUpdate.exe 96 PID 5036 wrote to memory of 648 5036 DropboxUpdate.exe 98 PID 4704 wrote to memory of 4776 4704 DropboxUpdate.exe 103 PID 4704 wrote to memory of 1148 4704 DropboxUpdate.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_c39a6427eace884c16120f538ff0dffb_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSnlyVmtvc0xjbUlMOG5QVHMxVHNsSlFLdkgyVF9NMzhTdUt5RFl1enpET0RfZlBNalJ5S3kwMjlmTDBDRTJyaUN6Vk16U3pORE16TWJVME0xVFNVVkFxVGkwdXpzelBpODlNQVdvMk5EWXdOek15TWJNd0JNb2JHNW1ibWdPVm1oa2JtcGtZVzVvQU9SYm01cGFHeG1hMUFCNmFJR0V-QE1FVEEifQ"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3484
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:4068
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNubHlWbXR2YzB4amJVbE1PRzVRVkhNeFZITnNTbEZMZGtneVZGOU5NemhUZFV0NVJGbDFlbnBFVDBSZlpsQk5hbEo1UzNrd01qbG1UREJEUlRKeWFVTjZWazE2VTNwT1JFMTZUV0pWTUUweFZGTlZWa0Z4Vkdrd2RYcHplbEJwT0RsTlFWZHZNazVFV1hkT2VrMTVUV0pOZDBKTmIySkhOVzFpYldkUFZtMW9hMkp0Y0d0WlZ6VnZRVTlTWW0wMWNHRkhlRzFoTVVGQ05tRkpSMFYtUUUxRlZFRWlmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjgxNy4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0UyNkZBNTU3LTBDNDctNDgwMS04NTk0LURENTIyREUxOEFGOH0iIHVzZXJpZD0iezkyMzMxRjMxLTM5RjItNEZEQS05ODcxLTZBMUZCRDVBQzlCM30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9InswMDU5OEQ5NS01OTc2LTRFM0QtOTNGMi1CNjAyNzMwQkM4Qzd9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjgxNy4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3956
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSnlyVmtvc0xjbUlMOG5QVHMxVHNsSlFLdkgyVF9NMzhTdUt5RFl1enpET0RfZlBNalJ5S3kwMjlmTDBDRTJyaUN6Vk16U3pORE16TWJVME0xVFNVVkFxVGkwdXpzelBpODlNQVdvMk5EWXdOek15TWJNd0JNb2JHNW1ibWdPVm1oa2JtcGtZVzVvQU9SYm01cGFHeG1hMUFCNmFJR0V-QE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{E26FA557-0C47-4801-8594-DD522DE18AF8}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4044
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:4776
-
-
C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdate.exe" /unregsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1148
-
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4832
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2308
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNubHlWbXR2YzB4amJVbE1PRzVRVkhNeFZITnNTbEZMZGtneVZGOU5NemhUZFV0NVJGbDFlbnBFVDBSZlpsQk5hbEo1UzNrd01qbG1UREJEUlRKeWFVTjZWazE2VTNwT1JFMTZUV0pWTUUweFZGTlZWa0Z4Vkdrd2RYcHplbEJwT0RsTlFWZHZNazVFV1hkT2VrMTVUV0pOZDBKTmIySkhOVzFpYldkUFZtMW9hMkp0Y0d0WlZ6VnZRVTlTWW0wMWNHRkhlRzFoTVVGQ05tRkpSMFYtUUUxRlZFRWlMQ0p5WlhGMVpYTjBYM05sY1hWbGJtTmxJam93ZlEiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy44MTcuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntFMjZGQTU1Ny0wQzQ3LTQ4MDEtODU5NC1ERDUyMkRFMThBRjh9IiB1c2VyaWQ9Ins5MjMzMUYzMS0zOUYyLTRGREEtOTg3MS02QTFGQkQ1QUM5QjN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7MTQ4QkYzRjEtRTAxNy00MjE5LTk1MzMtQkM5QTM0QUY1RTE2fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0NDNDYwODBFLTRDMzMtNDk4MS04NTlBLUJCQTJGNzgwRjMxRX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImJ1aWxkaWQ9bWFpbnxUaHUsIDMxIERlYyAyMDk5IDIzOjU5OjU5IEdNVCIgaW5zdGFsbGFnZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODc5IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:648
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e580955.rbs
- Size 7KB
- SHA256 0fc1a61d6513dc7dc855367f58e4eb16f1f23e201fd9e1cacba0e2c3507b7e0f
- MD5 ca22bc4d1baeff87b29b8c57abd42e8f
- SHA1 8abd80631d94fdad598c19bae2cfd65a0850af4f
- SHA512 7d897f79bfd8ad22600232bacae35cbfc78351de28cdaa0f9433962622feaadad1ad882dc064fdeb87fd6f9384e96139ac08a914fa07ee2e8f1bdaf657859808
- SSDEEP 96:h/8wyVReaV3JUciCsThqCeUciC6jeKTq+EThq4HNY5HVWM1CnCZsljeKx1Uy:hUe4CchIzchxKsIPvZsIKh
- TLSH T1C4F11041B640C2E2F8DB1B7CD71317523BB3D7C9A341634B48CD82329F977896E5A29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e580959.rbs
- Size 7KB
- SHA256 fbd92bbaa6ce71e19e2c94f5c9e6865d2d3e2a8c781d6428ae62dd9dfa78086c
- MD5 165406e0f374f97daaf8cff719c2d8ec
- SHA1 c859b834576acb809965505d913ac604de1e6866
- SHA512 afdfd5bbd7f4b2be3279c01f45d75f311391671ae8451412f1a03bbb5d24ee58426c5c4c5999711b7bfd6ebfb0fe5fa0e1546b0da25f76389d87e5c9f538e796
- SSDEEP 96:P/Ill+W8RM3Rx4t8Re3RCjewC8q+c+14JqOIdjewbpr59ojdyia:PdRkRpRSRZ8O1S8+
- TLSH T1ABE12241A600C2E2FDEB1F3CD72317613BE3E785A305434740CD55729B5A7896EAE2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\@PaxHeader
- Size 28B
- SHA256 1214977177e930ea153269dafaf50e3db54b2655001ef14cdd2c24f507dc9b11
- MD5 3c910229a04442a11300d2ebede97c2d
- SHA1 919667576fbe9910097541bd5cb220bfb99ce081
- SHA512 1f27fdba09cae0acb069693e954f4a3fa97e186652be317767ae524eb8960abe6ed232cb99204d5ef9f32471c098a3c5a999d3cd84052cf4eb37502068b9d9ae
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxCleanup.exe
- Size 299KB
- SHA256 0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72
- MD5 8fa7f9a62ea19f3691e8a24833a5bc25
- SHA1 23f0825ce2f4731cc73e82ca814872b512d333dd
- SHA512 3d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4
- SSDEEP 6144:4b/v8TwC+G634GKoC9U3+VEH3Z9E4argvgvv+AOFcmFdNH3P:4b/4+G634GKH9U3ZDqWw4NH3P
- TLSH T148547DD0B551CC72F4F31432183CAB7655AEB528FB6146DB63940A2DCE336C39E31AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdate.exe
- Size 127KB
- SHA256 7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
- MD5 8ad76e0b347bb690697535ce95b1c656
- SHA1 10d2622a3965d21215a953ed924d01788a9805ed
- SHA512 35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504
- SSDEEP 3072:SvZOOxLE4GTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SwOxLEbTQXLz
- TLSH T1EDD3C5C1F6B84CB9F4F35A390429867295BFB93DF922864E2994015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateBroker.exe
- Size 75KB
- SHA256 4988fdaeb6a33a3169a9ea445f5bc00b7bdacb78f7ed6a98b2ad2eb73b551ff2
- MD5 2677fb41f870e8a05cd60d4b7861e300
- SHA1 b5275ca2df2865b96fc359757564febb44f34278
- SHA512 d4aae16b4ba3b0b6b247fa29ca5baaf322ff0f6d941596f6ff2bf5eb1184162e2a1802d97f3040bfac3ab162259c8e4115445d23dab459e65fbad5cdd06e5ed1
- SSDEEP 768:kDbwKvIIfEr5EJFQp18EMUpVP2n6lexSXBNQlhgtfWd2Q3DG+AMxkEJ:kDbwk6WQfAUDPlDQlhgtfWYux
- TLSH T1E673D4D1E470CCF2F0F75C7D206C96725AEFB51DF6A04046269852AD4B63EC35E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateHelper.msi
- Size 26KB
- SHA256 0772c75f19a0e35b3b02831563a72897d68fc7eb2b304f2d7cc58eca0a00cfe5
- MD5 ad80274ebc288f8bcbfd7bf1e6b784a2
- SHA1 7bfa68f1fa73986dd9c13ee719a2c0bc9bc2b9e8
- SHA512 d6a37fc7da74544d672ba98f07dbe2f521216ac1b383209d943ee0d8ff9aa9a66aa8bfe933a0df5baad7740ad913b559f89cb57de44acf5d4cfcc11f3bd177af
- SSDEEP 384:Ax5Pey3M5IC0ioXvsSkAoEDGsC0AM+o/8E9VF0Ny+QkUYoXNXYpkuL43G:EeWMmCEsODGsAMxkE3kr2dYp7t
- TLSH T1A0C23A17B6009932D8464F7165AAC7A98B31BD459F924453329BF38C1FB2BC176FE2E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\DropboxUpdateOnDemand.exe
- Size 75KB
- SHA256 70272968ff5e1c47883ecb74680cf3a298af7b87ccacb932a57a0198ed69a65e
- MD5 7d0be196d264cf662aa2edfff9fbde8c
- SHA1 58820a86a093b91ba563402d1e9be233c19de9de
- SHA512 78f1621513b5404c53a485258d9a027ba619ca570bfb018e1a1f1eaca23ab4e79bd714c2cc3d1ab55ba0abb84c0af7b64d14bb7ac89225a5d2c817c75d1b9927
- SSDEEP 768:oVb4KvIIfEr5EJFQp18EMUpVP266l5xSXBNQ2hgtfWd2QzDGNAMxkENn1:oVb4k6WQfAUDPMuQ2hgtfWYnx5n1
- TLSH T1A073D4D1E4708CF2F0F75C7D206C96725AEFB51DF6A08046269852AD4F63EC35E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdate.dll
- Size 1.1MB
- SHA256 34b68127792f3c80c4a3e616c9c8cff8e53533518f80c4aac78f2aaa26e9615a
- MD5 4afe69cbfdbf9914ec0c597f5bc5a1f9
- SHA1 88e03e83a62e5fc37c94b26e6e5547b4ca7ead9d
- SHA512 1cc19966856b1495334d606ea8e9269f9203a6cb5d9dbb919c3485b0ff9e1941305af062e3a0e740afd2d2d6be8a4d50882c428c8058a2b1f8dbba4cd59f8fe9
- SSDEEP 24576:6+mp1aX1/jO3ZnRdhCLWNqghNEuCKS2wHrGw6x/TQX6:Xmp1aX1bO/ZNqghWUSnrGw6x/Ty6
- TLSH T128354AD237E18834F9FB0A38E57AA675AD7E7961F930C40E4750895E29736C2CC3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_da.dll
- Size 32KB
- SHA256 8fadf121a5766032bfddd0f6342dd6e2a612996370ed1f5c548f5cbb5ac548f9
- MD5 1ac5617cafffbb69ab768095c77b4306
- SHA1 c120a49e4886f839fb96c84f87727dd023fcec19
- SHA512 fd26156f9651f5237df3461128547496ab623c5a34c691f410177c3198608de8618a199f48f3a02155ed3fcb8d9717fd3c3cc8834013a99f1dffa4f3d8913ff0
- SSDEEP 384:7b9XpDshgWIPuEQCauBL51kw9J+BTIDGsNAM+o/8E9VF0NyZN:X9XNZWI6CamV+uDGoAMxkER
- TLSH T12DE2405257E85A18F6FB2F30BCB945614975FC92AD38C62D3344A05C0D32785EAB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_de.dll
- Size 35KB
- SHA256 9373bfaac15573f63b42cbcd39e4ef15a06d6a27696541f1274a2aef25570e70
- MD5 8ec648743a036ef57ee419488b01387f
- SHA1 afa9fca0cfb21cc1f05b31f1b55b1f47e18f0a88
- SHA512 a7af27890c0fe3f86bff9ae03734442a2c0b4d9315a5a6221531270caa8dd6e55e66659f6c1062d589a08a41a92dc4101f76430d528694b037de73b4407e4e5a
- SSDEEP 768:K9XNZWI6CF/+1KfK9YpVpDGkSAMxkEP5o:K9XThBF/+10iSuxVo
- TLSH T1D1F22E5247E85908F6F76F30BD7892654E72FCE2AD74D96D2340A06C0871B45EAB8B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_en.dll
- Size 31KB
- SHA256 67d5c3f8a6e9415deef22148a4216518a7ee52b468ba6bb1c67020d56d9e3745
- MD5 fc198c77a954eb0eda8424eac724584f
- SHA1 d1bdeb781372cd4907e519c2fd81094441385536
- SHA512 74572d8422a57046ccf5729eae36c396028b9162581dad80f20299fa11426bf453a7ba5a34022ec3103a7b995aa9e77f5dc44ba9de1570b03b964b38559306d6
- SSDEEP 384:Zs9XpDshgWIPuEQCOUNagyyyRJLqDGsaIAM+o/8E9VF0NyTT:m9XNZWI6COYagyySJODGlIAMxkEJ
- TLSH T1A3E25E4297F81918F6FB6F30BDB495614D35BC52AE38C66D2240D02D4972B82EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_es-419.dll
- Size 33KB
- SHA256 4d43704f744093b41f9d3315c508933a91c481732b84e0b14bf642aa5d03e020
- MD5 07cf9b2367462de21cd1c1ee5ef076ae
- SHA1 15676dfe46d54e7a609fea052010b847709535ee
- SHA512 a96d4b80215adc19f7af295e863017bf895038ea1346222337842139d9e5de018f8706fbb251d4012db262bc608a9ae4ae21dca08df3a5621d7e00281a491942
- SSDEEP 384:HtY59XpDshgWIPuEQCznAE/yedz9ydDGsjwtPAM+o/8E9VF0NydLD/HN:HQ9XNZWI6CznF/lzwdDGWePAMxkEfHN
- TLSH T156F20B104BF86A46FAF77F30A87856658D3ABC92AC38C55D2200A52D0D71F45EE78B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_es.dll
- Size 33KB
- SHA256 7dc6bb82fb6133e879309b0200aec7ae7c6346deb05a53daf1803443db3c8cbb
- MD5 0e13d60b08d0653ccad9cd22cf13ec85
- SHA1 2ac7fef4c9be1efca0c68ce7bb4b623d2824994f
- SHA512 94909d3e43cb0a90c6fc595fb24c5a90df4f9574bbc4f447dd534e6114c14f6905bb07a758719fd45fd357f28575bdd3043335ac0dbfe498ff3c286654b9ce6a
- SSDEEP 384:xV9XpDshgWIPuEQCnTDhLLWS27adtKoDGsxpYAM+o/8E9VF0NyXz:79XNZWI6CnTlL/27avzDGK+AMxkE5
- TLSH T1B5E23D108BF92A45F6FB6F30B87455654D3ABCA2AC38C65D2250912D0D71F81EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_fr.dll
- Size 34KB
- SHA256 3f3ac9e29e480d1c6eb271a538bb966953c9464659d044cdccd8c99df7f703a1
- MD5 ffdd38e5ae41822c584b092eefed9df0
- SHA1 91da41c12fa3afcac80d0077c0b3fce918b5a4f2
- SHA512 e06d12b1caf8c23496c7a75f7454443ba721691e245d183ec750e95b013423310e921587c0d95e5ecce1a816c8b538290f3018b098c788f0e14403fa3cce9a0c
- SSDEEP 384:+n9XpDshgWIPuEQCpxPdPtF0IK9qMhGxsDGsjAM+o/8E9VF0NywFqp5+:49XNZWI6CpldPts9waDG0AMxkEhp
- TLSH T187F2FA5297E85A01F6FB7F31B8B981214E3ABC9A9D34C52D2240D09D0D31B45EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_id.dll
- Size 31KB
- SHA256 e0d5ea9edec2692553371e4579a63d5dc7c554867f3f90ebec722d97d2af87b5
- MD5 5ea2ba9a437c4b6bfbb228356ea3be59
- SHA1 19d27cf893537002313808a4e32581f344e4eaca
- SHA512 fb78b0c4d7066922cfa7a234e6e2023042d3e2f25cc6a6be5eb26782d836bf30f090eb15be77b4c211e9c7fd8bc28b7e92e50cb7bb2a045412c74e8982049fcb
- SSDEEP 384:dZ9XpDshgWIPuEQCp+DHDWq6elDoWoRncvCPHlU6jIDGsfpAM+o/8E9VF0NyWswv:D9XNZWI6CpybEvuzDGWAMxkEn
- TLSH T133E22C9143E8A908FAFB4F3065B856650A37FD63BD34826D2340A5284D727C2EE35B76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_it.dll
- Size 33KB
- SHA256 83c860a5942fd6b307c428869a1debb188fa4a8dc27d2ffe4abe0b8453254e7b
- MD5 cf26a8d0d58a87db417185922c761687
- SHA1 e28c3c48594d5aef78966d0e210dd826c2f69a2d
- SHA512 fad6342c211b0597a9962c0bceb853e07f705f42baf92ac7a288fe5ea608c038923f509d9d77041eaecfa6f5f926138b524ee6cd4154526169eabb675c5ee9b9
- SSDEEP 768:b9XNZWI6CbMr0mhzICRfDG5AMxkEH9v/o:b9XThBbMomVgxb9v
- TLSH T1AEF2721197F82A04F6F77F30B83896694D36FD52AD38C62E2241D05C4932A95EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ja.dll
- Size 27KB
- SHA256 016567f8ee776cb57dfbc7e6a8908bef7004fd9abab4286800863c745c08e1c0
- MD5 d22b960d1fa795eb7996d1be6a02aab2
- SHA1 e526d5ce5719e1de891169305a367677f76e6e7a
- SHA512 40064f12538c55c2589bfa40ac8559aef71177ff7379e89c68ccb509c012a4295977eaf87e3a7be50c30e36d276b798217d7ce902240480f54f35fe44497d2ce
- SSDEEP 384:Bg9XpDshgWIPuEQCBM49uttlSa/9sWTDGsTsAM+o/8E9VF0Nyd:y9XNZWI6CBxyOWTDG+sAMxkE
- TLSH T1CFD219465BE04C0AF9FACD329094A5295A38FC326DD18D613140E4264D71BCBAF67FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ko.dll
- Size 27KB
- SHA256 4638e83c8e01e837078797f8ce2e4015a05aa7e6ee121dda107adc473f4c281b
- MD5 19b6ce8683c1d7a6ed07b93966b5e415
- SHA1 9ec79b491b4cc71fe6a3431ceb5fc26a217fed57
- SHA512 1fb52b00a2ed152a199357bff6fe4f994c7ba434bc3f3da960cf2a9ea52f41dae9cd3a0b840c87e25ff463077f1c32fc0f354fb24288c46a251e51b47f57ce80
- SSDEEP 384:Pu9XpDshgWIPuEQCOZuEFzcZhvt01ANY+UslmzkB3rXmNZYB5HhYKWvk/ugDGsL2:W9XNZWI6CO4ecZDPkWfB//DGOAMxkE
- TLSH T1E3D2291382A4EC01F9A9DD3264C49B7A8135ED226E178166B380F0785E727C2EF797DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ms.dll
- Size 31KB
- SHA256 d7e3c82e12447a9aa4085317f65447607b75f62fa89edd38fb5621dbaad9211d
- MD5 6922f23814bd549972b548acc4e6afce
- SHA1 17a6e724904a09175b1c3ecf40e6929b89662585
- SHA512 f59d9e56e2a06fbd8853bccae6e69f6b51c07bc9c18c84e559d6e81bdec90c51c555676891d9a9c6233faedfacfd15941abd1c033710e14ba028cf82557109eb
- SSDEEP 384:JF9XpDshgWIPuEQCSLhYV7ZZgZuG3yK6jFJHgcO/2WfdqJBAQCRNDK3DGsGqRAMw:/9XNZWI6CSmqDz+DGpqRAMxkEq
- TLSH T1DDE21B9153DCA948FEFB8F3069F856614A27FD53BD38826D2340A5284D31AC2DE35B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_nl.dll
- Size 34KB
- SHA256 5f577d78457e5010c90b3614f94eb3b03f4f66c752191e25ce2b4f397d481ad9
- MD5 7d26147723dcf53d0d1b10f98f891d91
- SHA1 501674d1e4d53d0d6b92875c65118f7f5ceccf66
- SHA512 deefae29107edd6c240308b7e05680b1f9a8f2525fff29a6cc47742345a21f285c6285440c26a36555b97b1d73e8b16a712177f8fcef70aea6d5da0e35123f15
- SSDEEP 384:rm49XpDshgWIPuEQCGnoBYUEz8BxUUNOQDGsVzAM+o/8E9VF0NyZuC:q49XNZWI6CGBlQEGHDGuAMxkEyC
- TLSH T199F21A4257F85918F6FB6F30BDB885608E76FC92AD34C66D2240A56C4C31681EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_no.dll
- Size 32KB
- SHA256 8a1622e758b4cdcdcef80095f59c604ba878b1c853d66a338459b4de32ed5fdb
- MD5 6bfb6b741d1eb83a8d1a96680bc6da51
- SHA1 9263e45de354b17b9091b688ac63aa31796647e1
- SHA512 d65093e4c85cfa22054c9c09113a36360b23214ccf7f6cdf84df0d4d8a905ffa6a20e8385fb3fcf78fb96d91ce49f29826c07ee81fc62507218b48ef6231a5ed
- SSDEEP 384:8pKaq6Kaq6Kafv/Pe9XpDshgWIPuEQCHK3/IGDMsiKVtP2DGswNAM+o/8E9VF0Nf:l9XNZWI6CHatDviKVx2DGzNAMxkE
- TLSH T196E2825197E85919F6FB6F30BCB845254975FCA2AE38C61D3240A06C0D327C6EAB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_pl.dll
- Size 33KB
- SHA256 16ffbd7af2dc7d11199bd769ac3355efb39b4267f0758ef8d60ce4bdf927d394
- MD5 1eadd3df335b90ee62a74966c1693af5
- SHA1 21e5152b54f08317f13b6c97ffd67d4d42e76aae
- SHA512 9b9776d5e0e47acc6234913faf2421da4c896abe84f7129a928393d5ccc491ff8a92b82ef3b76b493e620bc6942e3248bc364f8669ebe2444fe477ed37956e8c
- SSDEEP 384:z09XpDshgWIPuEQCmJVL7bHNzcjANLsMnZaDGsDAM+o/8E9VF0Nyndr8:A9XNZWI6CmrTLZ0DGUAMxkEM
- TLSH T12AF25641A7F41940F6F7AF3075B862658E7ABC22BD3481AF3640D1190A71AC1EE74B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_pt-BR.dll
- Size 32KB
- SHA256 b500301065031c6826991f0b0e712e2ac09c465f686b27e0aa5121a9d2bc2529
- MD5 2ea9dbc90cf842de5ac5cced84d83a8d
- SHA1 2a63a275a4d4252d4e92a2e2d5827f1cc1789a4b
- SHA512 57d50c6124273655e4cbd3c476882b7795e3d58c44121c5260bb9efcfed75fb708e622eb4e67dd4e1dfb3fa7e1b9680ae35a51248c8dc901c64c6fc708c46fa2
- SSDEEP 384:hMuq9XpDshgWIPuEQCAqYlFEZnK+J1vDGsJ8AM+o/8E9VF0NymHjhT9:h7q9XNZWI6CAbnEZHRDGM8AMxkEChT
- TLSH T19EE2614287F81A04F6FB7F31687856258D37BD62AC38C55D2250D0690E71B82EEB9B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_ru.dll
- Size 33KB
- SHA256 8e5ddf0615b84665e5cb5b13a0d5f72167c82dc4a86cc49616ea445f6b801eaf
- MD5 ce5254b7aa5cc2482449b12995976bc0
- SHA1 d8aba69d1b11eae587c1e5357e08f3c66acc1c1e
- SHA512 5dc50fec4f9685f74d4638ed0e2f8e4c493ddc10af0416a1fc495782962d16b158bae71171338230bd17d91cc686c3e9b82febb006c634791560385328b3ed3a
- SSDEEP 384:lO9XpDshgWIPuEQCl4oKN+5N+JnYOk3oyq3Lbq9DYNdDdHt/ymdDGsqCAM+o/8Es:c9XNZWI6Cl3joyHZmnNdDGzCAMxkE
- TLSH T11DE2850FEBBC9800F468DA751A6689E71024FF206B1985E6719FFC70642877277293CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_sv.dll
- Size 32KB
- SHA256 401263a24666710b8895e0d5fa5857f7d86c4ec21595573894e07517e94b52ff
- MD5 c8a5dea2d0343249eac44e0dc550b2dd
- SHA1 681081760d2983f2025e21356397b5bc067c3501
- SHA512 bfceea37a5e525738380ee9049daca1913da5603ead0057f5e8f54022961db1cdf0da370e1af8b841997f1e46514eb5f4e3c4492cba66c83d6eaba1a568fe05a
- SSDEEP 384:069XpDshgWIPuEQC3GFD3ciot2QQEgz/NDGslrAM+o/8E9VF0Ny2hC:/9XNZWI6C3ociotgEADGqAMxkE
- TLSH T1C6E2414257E85918F6F79F30BCB886214875FC92AD79D62D3300D5AC0D31B86EAB4B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_th.dll
- Size 31KB
- SHA256 63e7af52e0f6e41c351d33ed4928647ab3abbca3c767de570891c3ada13d4e1e
- MD5 1881415301940deb7d45b120a39679c7
- SHA1 3bcc72d91e9a1c35f5b52768c9a77a0faf2f16e0
- SHA512 6f35a017af72df217eb3e511f57d8c4796cfd996f30308cedf7b44c16cff3d34fbf5745df00398c1232e7f685425a2269cd1d35184c6b2007afaefed25549188
- SSDEEP 768:Q49XNZWI6CPeRUkGGq2aaLxo2qQ5XDGYoXaAMxkE1v:Q49XThBPeRUkGGq2aaLxoZQ7oox9
- TLSH T1C1E2A57482B12B02D55BC8B0E1C44E737C2CED21DC1AC1A1A1AFDD345A317A6BBF996D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_uk.dll
- Size 32KB
- SHA256 cbd96676b5097470250dc8285c6523ed598ccb58a4990c78abba79d4e1a67e9e
- MD5 17c6392aad88515222ffc54dad9a0f36
- SHA1 9f0dad897f9648167b9f005b7e2ab86c6161e6d5
- SHA512 b5bd6ab5325e772347ab8de55ecaae8546b46bd9dc559c17c3b965b4627cfa25c406f4ca6bbe17f22e21678c80a3ec03260242f29b1beb817d78639e37a2f940
- SSDEEP 384:Ne9XpDshgWIPuEQCFbSb0sS5kU40ryH5oHXmUzdkPhMDGssJAM+o/8E9VF0NylJO:c9XNZWI6CFmvoHSMDGLJAMxkEY
- TLSH T1E8E2950FE6B88910F658D9315A92C5EB0438FF212B98C5D6724FF830282977777256DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\goopdateres_zh-TW.dll
- Size 25KB
- SHA256 2217e104660a21c2c9be0ad68846fbb4f7ee16510ece768f055d9e9cbbd60a9b
- MD5 dbd5fa781509ed7d863ca11877f2a28e
- SHA1 1b52ae5bb49c06ec7c25b7675093846978dc6856
- SHA512 7d9b04cbc040ed6c4df8e10fbafec70500c9fcfe228a86e8ccbec4945bf04ecca6a475e20f4cbd36e5a89c6847e6107496ee23e36db0d748104bb01af8985505
- SSDEEP 384:rk9XpDshgWIPuEQCLJQ6ql73inVv0WG3DGsUOAM+o/8E9VF0Ny/ITV:Y9XNZWI6CLOl7nr3DGPOAMxkEwV
- TLSH T1B0C2390247D46C01F9AE9D32A0889536C632FD222F55C5B63185F4315EB2B83EF6E76E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\npDropboxUpdate3.dll
- Size 273KB
- SHA256 e07b2a1d2c932fc38d3fa6401ff0be653250a1e8173311a9312ef9478da28e2a
- MD5 52d461eb7ce99d0e6901eef682d83bb5
- SHA1 c317560a11a91287dd31db5eeb2a1145f711c09d
- SHA512 429d18c1d8482469916627e32fd938f7d770b391e50f249b79bc7e0553f6b1633fdd0f0e54c069e23a22d8a174047c71dfbfc7740a026b414d56556accfd2bab
- SSDEEP 6144:ImHPIkppRftxVLbwK7wlTHFTn2UONZ49Ig:TPJ/ftvLbwK7wlTHNoZ+Ig
- TLSH T1E1549D123BD4C076E8B70934A6E3EA526ABD7D315934C84FB798984C6F71B82D635313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUMB.tmp\psuser.dll
- Size 211KB
- SHA256 56ec8884c392f95202d07959414d256c737354ad3243971ef47e44a32f011aa5
- MD5 732dfd011b5e71f1f18229e93d8ae039
- SHA1 6ff911e082622bb6ba0f43734a17de3963a29c43
- SHA512 376df248b77a07df573b1fb3fe111d0ba4f9e91e4fbedfda24732159bb4eb359e3f6e91de13f6f698896a0a64a39c68b0a8d125efd588b5ece762daf985099fb
- SSDEEP 3072:buPri9lyPPil5mTWfMk7u/SHwnNOlCiQ7Qt9Q6cHURFX3zQWS+y:bQOGCjmTWEk7YSHwnN0kstjcHs3y
- TLSH T126248D1132D0C036D66F103944ABC7625BB97D306FA4C58B3798BAAD5F70786EB36392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe
- Size 129KB
- SHA256 2e3925b6c2175a98024551fea9e0b8dbc54f4107322c97b1493add40ed8ab73b
- MD5 e3214461da70a51d0fe6ab76dcc753c1
- SHA1 5ce885de14919fd7ba6ce35726480b098eaf5acc
- SHA512 67668b4ce7102480a0f37113922c9197ebe90619a2cded3a484024902f167bc005fe11f50e3d9509e2d4a4cbad1865f61b20189ddf37e916ff01bbf38e9e2aa6
- SSDEEP 3072:FZOOxLE4GTnycyp2QltfWCE07WIqvO9TDd1nEaHNV2304cj:2OxLEbTi9Xj
- TLSH T1D2D3C6C1F6B88CB5F4F35E395429867285BFB83DF922864A2994015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-CN.dll
- Size 25KB
- SHA256 084a88a2171690934370cc603c0d809ffb9f0e55aeaa4055f38af2239d0606e5
- MD5 0a62f2c2d232d98a8438a3d449a520f3
- SHA1 308fef4ccf6926977e5bc1064f554fab0d4ba36a
- SHA512 db74ca3fce77ce1207041494c9b4d1e86c39e9e796e8e8a31ac53e6db187b4cdc70f3b330d77db0ec0b2282b76fe9da379e7065c042993fd9044e5c1c7dec13a
- SSDEEP 384:X19XpDshgWIPuEQCYPBKPRpDGsSAM+o/8E9VF0NyDpV:l9XNZWI6CYpKPRpDGBAMxkE
- TLSH T1EFC22B1647D02C40F7BE9D31A08995358532FD236E84867B3184E4355E72B83EF7ABAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll
- Size 211KB
- SHA256 3582062df2b1120e6cbe47a4c5066b0f3e0959518ab572a62f2817e55bab6518
- MD5 70663a8818622003e50b36bb392b880e
- SHA1 23670b780d232e70a6cfa5b2d350992d43ef722a
- SHA512 0a62442874598ed8e7986a99dd9d9d4d07e987586454731feea6427fd9b2190d5d2fc502e2efade839d010ac7e11135daf0921275a911037284ebfbf8bd3c3e0
- SSDEEP 3072:guPj69lyPPil5mTWfMk7u/SHwnNOlL7Q7Qt9QQcHURFX3zQWr+D:gQ+GCjmTWEk7YSHwnN0gsthcHs0D
- TLSH T156248D1132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5F70786EB36392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
- Size 924B
- SHA256 c571108eeb41b82b45bab805f9cfd75786414f9238aa8fdbbdfa449d9717b3fe
- MD5 9f200c02273ea94fa5ee54a4e078aec3
- SHA1 265a4e6af7b9c327a2b64fe8a2fcd26fe57e8697
- SHA512 6eea366fb957d41d6b2d863790889509c3aa9e16ef31730e47c0f2f892651de6bd6bf2b64bd7c38d877b1c240ee7d8876c262af9def5030543b7d386ce30745f
- TLSH T1D611295177FA4124F6F77F716AB059A1467BBC22BE30C64D1011044E4DB3A91C970B23
- MD5 SHA1 SHA512 TLSH