Analysis
- max time kernel
130s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
13/08/2026, 02:48
General
- Target 2026-08-13_f61265591e99e450aabbec76f4ebd5c1_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 783KB
- Sample260813-daw1tsyths
- SHA256 1da6e71d66251b5e6cf17b7c8f252ea85e04069e37f6cbdfd65a086cd6767c85
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Drops file in Drivers directory 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 41 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 21 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 53 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_f61265591e99e450aabbec76f4ebd5c1_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f61265591e99e450aabbec76f4ebd5c1_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Temp\GUM455C.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM455C.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055enNPd2pBTUFOQ3JWSmtScWgwN3R0azc4bGxZV0NxZ1JZMHF0YWdwUVFyaTd2RDI5M0hYMXpxMDZ6ejJrOXRWcnFRanZwY0hENmRiZnU0NWwwYTdmTGluT0M0RkwtVzhCZkcxQVJPUTIxUXU5U25GZVdwajk4OFFSTEFPcUtvZ1FrTElDdDRNMWN3SDhnd0d4UEw5QVhqb0lXZ35ATUVUQSJ9"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1ZW5OUGQycEJUVUZPUTNKV1NtdFNjV2d3TjNSMGF6YzRiR3haVjBOeFoxSlpNSEYwWVdkd1VWRnlhVGQyUkRJNU0waFlNWHB4TURaNmVqSnJPWFJXY25GUmFuWndZMGhFTm1SaVpuVTBOV3d3WVRkbVRHbHVUME0wUmt3dFZ6aENaa2N4UVZKUFVUSXhVWFU1VTI1R1pWZHdhams0T0ZGU1RFRlBjVXR2WjFGclRFbERkRFJOTVdOM1NEaG5kMGQ0VUV3NVFWaHFiMGxYWjM1QVRVVlVRU0o5IiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuOTExLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Nzc3MzdDRjEtRDc0NS00NTczLUJGMEYtQTJFNDA2M0ZCOThGfSIgdXNlcmlkPSJ7Qzg0OEEzRUMtODRCQy00NkYxLTkzOUMtRkVDOTJCQUUwOUQ1fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezkxNjYzMDUzLUMwRTAtNEE5OC1CNDZCLTU3QUQ4MjUzNzAzNn0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjI2MTAwLjE3NDIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuOTExLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055enNPd2pBTUFOQ3JWSmtScWgwN3R0azc4bGxZV0NxZ1JZMHF0YWdwUVFyaTd2RDI5M0hYMXpxMDZ6ejJrOXRWcnFRanZwY0hENmRiZnU0NWwwYTdmTGluT0M0RkwtVzhCZkcxQVJPUTIxUXU5U25GZVdwajk4OFFSTEFPcUtvZ1FrTElDdDRNMWN3SDhnd0d4UEw5QVhqb0lXZ35ATUVUQSJ9&nolaunch=0" /installsource taggedmi /sessionid "{77737CF1-D745-4573-BF0F-A2E4063FB98F}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\DropboxClient_264.4.3421.x64.exe"C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\DropboxClient_264.4.3421.x64.exe" --channel-id=stable /S /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055enNPd2pBTUFOQ3JWSmtScWgwN3R0azc4bGxZV0NxZ1JZMHF0YWdwUVFyaTd2RDI5M0hYMXpxMDZ6ejJrOXRWcnFRanZwY0hENmRiZnU0NWwwYTdmTGluT0M0RkwtVzhCZkcxQVJPUTIxUXU5U25GZVdwajk4OFFSTEFPcUtvZ1FrTElDdDRNMWN3SDhnd0d4UEw5QVhqb0lXZ35ATUVUQSIsIm9tYWhhLWluc3RhbGxlci1pZCI6IntDODQ4QTNFQy04NEJDLTQ2RjEtOTM5Qy1GRUM5MkJBRTA5RDV9IiwicmVxdWVzdF9zZXF1ZW5jZSI6MH0 /InstallType:MACHINE2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\DropboxUnzipper_264.4.3421.x64.exe"C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\DropboxUnzipper_264.4.3421.x64.exe" --archive "C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\Dropbox_app_264.4.3421.x64.zip" --target "C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\app\Dropbox.exe"C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\app\Dropbox.exe" /install /InstallType:MACHINE /InstallDir:"C:\Program Files (x86)\Dropbox\Client" /KillEveryone:YES /IsAutoUpdate:NO /InstallerData:"" /ChannelId:stable3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe advfirewall firewall delete rule name=Dropbox4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe advfirewall firewall add rule name=Dropbox dir=in action=allow "program=C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any protocol=tcp localport=17500-175104⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe advfirewall firewall add rule name=Dropbox dir=in action=allow "program=C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any protocol=udp localport=175004⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.96.0.dll"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.96.0.dll"5⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.96.0.dll"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.96.0.dll"5⤵
- Modifies system executable filetype association
- Modifies registry class
-
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxOfficeAddin.14.dll"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/S "C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxOfficeAddin.14.dll"5⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\SysWOW64\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxOfficeAddin64.14.dll"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S "C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxOfficeAddin64.14.dll"5⤵
- Modifies registry class
-
-
-
C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxUpdateClient.exe"C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxUpdateClient.exe" --install-elevation-service --appid={CC46080E-4C33-4981-859A-BBA2F780F31E} --enable-logging --vmodule=*/dropbox/update_client/*=24⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
-
-
-
C:\Windows\System32\sc.exeC:\Windows\System32\sc.exe failure DbxSvc reset= 3600 actions= restart/5000/restart/30000//4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell "Get-AppxPackage C27EB4BA.DropboxOEM | Remove-AppxPackage; Get-AppxProvisionedPackage -Online | Where-Object DisplayName -In \"C27EB4BA.DropboxOEM\" | Remove-ProvisionedAppxPackage -Online"4⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {2E2F152D-5D5A-46C4-B411-040C190A0610}5⤵
- Drops file in Windows directory
-
-
-
-
-
C:\Program Files (x86)\Dropbox\Update\1.3.911.1\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.911.1\DropboxCrashHandler.exe" /crashhandler2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1ZW5OUGQycEJUVUZPUTNKV1NtdFNjV2d3TjNSMGF6YzRiR3haVjBOeFoxSlpNSEYwWVdkd1VWRnlhVGQyUkRJNU0waFlNWHB4TURaNmVqSnJPWFJXY25GUmFuWndZMGhFTm1SaVpuVTBOV3d3WVRkbVRHbHVUME0wUmt3dFZ6aENaa2N4UVZKUFVUSXhVWFU1VTI1R1pWZHdhams0T0ZGU1RFRlBjVXR2WjFGclRFbERkRFJOTVdOM1NEaG5kMGQ0VUV3NVFWaHFiMGxYWjM1QVRVVlVRU0lzSW5KbGNYVmxjM1JmYzJWeGRXVnVZMlVpT2pCOSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjkxMS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezc3NzM3Q0YxLUQ3NDUtNDU3My1CRjBGLUEyRTQwNjNGQjk4Rn0iIHVzZXJpZD0ie0M4NDhBM0VDLTg0QkMtNDZGMS05MzlDLUZFQzkyQkFFMDlENX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins3MDBFOTM5My1FRjU0LTRFQTQtOUI3My1BOTE4RUZDMUI5MDB9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMjY0LjQuMzQyMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImJ1aWxkaWQ9bWFpbnxUaHUsIDMxIERlYyAyMDk5IDIzOjU5OjU5IEdNVDt1cGRhdGVfY2hhbm5lbD1zdGFibGV8VGh1LCAzMSBEZWMgMjA5OSAyMzo1OTo1OSBHTVQiIGluc3RhbGxhZ2U9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjQwNDM1IiBkb3dubG9hZGVkPSIyOTQzODU2MTQiIHRvdGFsPSIyOTQzODU2MTQiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{49ac0db4-821d-4d44-b120-8ee5e653514c}\dbx.inf" "9" "482b6669b" "0000000000000178" "WinSta0\Default" "0000000000000174" "208" "C:\Program Files (x86)\Dropbox\Update\Install\{ADBF07DA-437A-45B7-BD0D-0FA89E7A8E83}\app\264.4.3421\driver_amd64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxElevationService.exe"C:\Program Files (x86)\Dropbox\Client\264.4.3421\DropboxElevationService.exe" --svc --appid={cc46080e-4c33-4981-859a-bba2f780f31e}1⤵
- Executes dropped EXE
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\dbx.inf_amd64_2758e227d1ac3410\dbx.inf" "0" "482b6669b" "0000000000000174" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\System32\DbxSvc.exeC:\Windows\System32\DbxSvc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\DbxSvc.exeC:\Windows\System32\DbxSvc.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:crashpad-handler --no-upload-gzip --no-rate-limit --capture-python --no-identify-client-via-url --database=C:\Users\Admin\AppData\Local\Dropbox\Crashpad --metrics-dir=0 --url=https://d.dropbox.com/report_crashpad_minidump --https-pin=0xfb,0xe3,0x1,0x80,0x31,0xf9,0x58,0x6b,0xcb,0xf4,0x17,0x27,0xe4,0x17,0xb7,0xd1,0xc4,0x5c,0x2f,0x47,0xf9,0x3b,0xe3,0x72,0xa1,0x7b,0x96,0xb5,0x7,0x57,0xd5,0xa2 --https-pin=0x7f,0x42,0x96,0xfc,0x5b,0x6a,0x4e,0x3b,0x35,0xd3,0xc3,0x69,0x62,0x3e,0x36,0x4a,0xb1,0xaf,0x38,0x1d,0x8f,0xa7,0x12,0x15,0x33,0xc9,0xd6,0xc6,0x33,0xea,0x24,0x61 --https-pin=0x36,0xab,0xc3,0x26,0x56,0xac,0xfc,0x64,0x5c,0x61,0xb7,0x16,0x13,0xc4,0xbf,0x21,0xc7,0x87,0xf5,0xca,0xbb,0xee,0x48,0x34,0x8d,0x58,0x59,0x78,0x3,0xd7,0xab,0xc9 --https-pin=0xf7,0xec,0xde,0xd5,0xc6,0x60,0x47,0xd2,0x8e,0xd6,0x46,0x6b,0x54,0x3c,0x40,0xe0,0x74,0x3a,0xbe,0x81,0xd1,0x9,0x25,0x4d,0xcf,0x84,0x5d,0x4c,0x2c,0x78,0x53,0xc5 --https-pin=0xbd,0xac,0xcb,0xf2,0xe8,0xb2,0x7c,0xc,0x2,0xa6,0x89,0xee,0x86,0x6c,0x9b,0x86,0xec,0x4,0x44,0x2a,0xfc,0xdd,0xdd,0x5d,0x4e,0xc3,0x6d,0xef,0x21,0xe7,0x61,0xdd --https-pin=0xaf,0xf9,0x88,0x90,0x6d,0xde,0x12,0x95,0x5d,0x9b,0xeb,0xbf,0x92,0x8f,0xdc,0xc3,0x1c,0xce,0x32,0x8d,0x5b,0x93,0x84,0xf2,0x1c,0x89,0x41,0xca,0x26,0xe2,0x3,0x91 --https-pin=0x8b,0xb5,0x93,0xa9,0x3b,0xe1,0xd0,0xe8,0xa8,0x22,0xbb,0x88,0x7c,0x54,0x78,0x90,0xc3,0xe7,0x6,0xaa,0xd2,0xda,0xb7,0x62,0x54,0xf9,0x7f,0xb3,0x6b,0x82,0xfc,0x26 --https-pin=0xb9,0x4c,0x19,0x83,0x0,0xce,0xc5,0xc0,0x57,0xad,0x7,0x27,0xb7,0xb,0xbe,0x91,0x81,0x69,0x92,0x25,0x64,0x39,0xa7,0xb3,0x2f,0x45,0x98,0x11,0x9d,0xda,0x9c,0x97 --https-pin=0x5a,0x88,0x96,0x47,0x22,0xe,0x54,0xd6,0xbd,0x8a,0x16,0x81,0x72,0x24,0x52,0xb,0xb5,0xc7,0x8e,0x58,0x98,0x4b,0xd5,0x70,0x50,0x63,0x88,0xb9,0xde,0xf,0x7,0x5f --https-pin=0xa4,0x95,0xc8,0xd1,0x10,0xe8,0xb9,0xe2,0x0,0xf3,0x70,0xae,0xda,0x3f,0xf9,0x2e,0xe4,0x3f,0x8e,0x3d,0x4e,0xc0,0xdb,0x1c,0xd,0xc5,0x8b,0xd7,0x62,0x88,0xb,0xa5 --https-pin=0xa0,0x2f,0xaf,0xa1,0x92,0xc8,0xcb,0x81,0xcb,0x13,0x41,0x55,0x4f,0x9c,0x5,0xb7,0x1c,0xca,0x2a,0x89,0xb,0xd,0x12,0x98,0xd6,0x83,0x64,0x7c,0x96,0x1e,0xfb,0xdf --https-pin=0x6a,0x97,0xb5,0x1c,0x82,0x19,0xe9,0x3e,0x5d,0xec,0x64,0xba,0xd5,0x80,0x6c,0xde,0xb0,0xf8,0x35,0x5b,0xe4,0x7e,0x75,0x70,0x10,0xb7,0x2,0x45,0x6e,0x1,0xaa,0xfd --https-pin=0x2b,0x7,0x1c,0x59,0xa0,0xa0,0xae,0x76,0xb0,0xea,0xdb,0x2b,0xad,0x23,0xba,0xd4,0x58,0xb,0x69,0xc3,0x60,0x1b,0x63,0xc,0x2e,0xaf,0x6,0x13,0xaf,0xa8,0x3f,0x92 --annotation=is_store_managed=false --annotation=machine_id=683d0c25-4b2e-43ef-9594-19585b50a2ef --annotation=platform=win "--annotation=platform_version=11 26100" --initial-client-data=0x360,0x364,0x368,0x338,0x36c,0x7ffbe75f4378,0x7ffbe75f4338,0x7ffbe75f43482⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:exit-monitor -method:collectupload -session-token:b6d383d4-0d2a-4a7a-81c7-6ade5558c627 -target-handle:884 -target-shutdown-event:876 -target-restart-event:828 "-target-command-line:\"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe\" /systemstartup" -python-version:3.11.14 -process-type:main -handler-pipe:\\.\pipe\crashpad_7348_GUJLPINLWPLELBCQ2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Dropbox\Update\1.3.911.1\DropboxUpdateOnDemand.exe"C:\Program Files (x86)\Dropbox\Update\1.3.911.1\DropboxUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /firstrun 1 /noappwasrunning /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055enNPd2pBTUFOQ3JWSmtScWgwN3R0azc4bGxZV0NxZ1JZMHF0YWdwUVFyaTd2RDI5M0hYMXpxMDZ6ejJrOXRWcnFRanZwY0hENmRiZnU0NWwwYTdmTGluT0M0RkwtVzhCZkcxQVJPUTIxUXU5U25GZVdwajk4OFFSTEFPcUtvZ1FrTElDdDRNMWN3SDhnd0d4UEw5QVhqb0lXZ35ATUVUQSIsInJlcXVlc3Rfc2VxdWVuY2UiOjB93⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:crashpad-handler --no-upload-gzip --no-rate-limit --capture-python --no-identify-client-via-url --database=C:\Users\Admin\AppData\Local\Dropbox\Crashpad --metrics-dir=0 --url=https://d.dropbox.com/report_crashpad_minidump --https-pin=0xfb,0xe3,0x1,0x80,0x31,0xf9,0x58,0x6b,0xcb,0xf4,0x17,0x27,0xe4,0x17,0xb7,0xd1,0xc4,0x5c,0x2f,0x47,0xf9,0x3b,0xe3,0x72,0xa1,0x7b,0x96,0xb5,0x7,0x57,0xd5,0xa2 --https-pin=0x7f,0x42,0x96,0xfc,0x5b,0x6a,0x4e,0x3b,0x35,0xd3,0xc3,0x69,0x62,0x3e,0x36,0x4a,0xb1,0xaf,0x38,0x1d,0x8f,0xa7,0x12,0x15,0x33,0xc9,0xd6,0xc6,0x33,0xea,0x24,0x61 --https-pin=0x36,0xab,0xc3,0x26,0x56,0xac,0xfc,0x64,0x5c,0x61,0xb7,0x16,0x13,0xc4,0xbf,0x21,0xc7,0x87,0xf5,0xca,0xbb,0xee,0x48,0x34,0x8d,0x58,0x59,0x78,0x3,0xd7,0xab,0xc9 --https-pin=0xf7,0xec,0xde,0xd5,0xc6,0x60,0x47,0xd2,0x8e,0xd6,0x46,0x6b,0x54,0x3c,0x40,0xe0,0x74,0x3a,0xbe,0x81,0xd1,0x9,0x25,0x4d,0xcf,0x84,0x5d,0x4c,0x2c,0x78,0x53,0xc5 --https-pin=0xbd,0xac,0xcb,0xf2,0xe8,0xb2,0x7c,0xc,0x2,0xa6,0x89,0xee,0x86,0x6c,0x9b,0x86,0xec,0x4,0x44,0x2a,0xfc,0xdd,0xdd,0x5d,0x4e,0xc3,0x6d,0xef,0x21,0xe7,0x61,0xdd --https-pin=0xaf,0xf9,0x88,0x90,0x6d,0xde,0x12,0x95,0x5d,0x9b,0xeb,0xbf,0x92,0x8f,0xdc,0xc3,0x1c,0xce,0x32,0x8d,0x5b,0x93,0x84,0xf2,0x1c,0x89,0x41,0xca,0x26,0xe2,0x3,0x91 --https-pin=0x8b,0xb5,0x93,0xa9,0x3b,0xe1,0xd0,0xe8,0xa8,0x22,0xbb,0x88,0x7c,0x54,0x78,0x90,0xc3,0xe7,0x6,0xaa,0xd2,0xda,0xb7,0x62,0x54,0xf9,0x7f,0xb3,0x6b,0x82,0xfc,0x26 --https-pin=0xb9,0x4c,0x19,0x83,0x0,0xce,0xc5,0xc0,0x57,0xad,0x7,0x27,0xb7,0xb,0xbe,0x91,0x81,0x69,0x92,0x25,0x64,0x39,0xa7,0xb3,0x2f,0x45,0x98,0x11,0x9d,0xda,0x9c,0x97 --https-pin=0x5a,0x88,0x96,0x47,0x22,0xe,0x54,0xd6,0xbd,0x8a,0x16,0x81,0x72,0x24,0x52,0xb,0xb5,0xc7,0x8e,0x58,0x98,0x4b,0xd5,0x70,0x50,0x63,0x88,0xb9,0xde,0xf,0x7,0x5f --https-pin=0xa4,0x95,0xc8,0xd1,0x10,0xe8,0xb9,0xe2,0x0,0xf3,0x70,0xae,0xda,0x3f,0xf9,0x2e,0xe4,0x3f,0x8e,0x3d,0x4e,0xc0,0xdb,0x1c,0xd,0xc5,0x8b,0xd7,0x62,0x88,0xb,0xa5 --https-pin=0xa0,0x2f,0xaf,0xa1,0x92,0xc8,0xcb,0x81,0xcb,0x13,0x41,0x55,0x4f,0x9c,0x5,0xb7,0x1c,0xca,0x2a,0x89,0xb,0xd,0x12,0x98,0xd6,0x83,0x64,0x7c,0x96,0x1e,0xfb,0xdf --https-pin=0x6a,0x97,0xb5,0x1c,0x82,0x19,0xe9,0x3e,0x5d,0xec,0x64,0xba,0xd5,0x80,0x6c,0xde,0xb0,0xf8,0x35,0x5b,0xe4,0x7e,0x75,0x70,0x10,0xb7,0x2,0x45,0x6e,0x1,0xaa,0xfd --https-pin=0x2b,0x7,0x1c,0x59,0xa0,0xa0,0xae,0x76,0xb0,0xea,0xdb,0x2b,0xad,0x23,0xba,0xd4,0x58,0xb,0x69,0xc3,0x60,0x1b,0x63,0xc,0x2e,0xaf,0x6,0x13,0xaf,0xa8,0x3f,0x92 --annotation=is_store_managed=false --annotation=machine_id=683d0c25-4b2e-43ef-9594-19585b50a2ef --annotation=platform=win "--annotation=platform_version=11 26100" --initial-client-data=0x340,0x344,0x348,0x31c,0x34c,0x7ffbe75f4378,0x7ffbe75f4338,0x7ffbe75f43484⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:exit-monitor -method:collectupload -session-token:dfa5670c-541d-4424-9759-9440bd6b8ab9 -target-handle:596 -target-shutdown-event:844 -target-restart-event:484 "-target-command-line:\"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe\" /firstrun 1 /noappwasrunning /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055enNPd2pBTUFOQ3JWSmtScWgwN3R0azc4bGxZV0NxZ1JZMHF0YWdwUVFyaTd2RDI5M0hYMXpxMDZ6ejJrOXRWcnFRanZwY0hENmRiZnU0NWwwYTdmTGluT0M0RkwtVzhCZkcxQVJPUTIxUXU5U25GZVdwajk4OFFSTEFPcUtvZ1FrTElDdDRNMWN3SDhnd0d4UEw5QVhqb0lXZ35ATUVUQSIsInJlcXVlc3Rfc2VxdWVuY2UiOjB9" -python-version:3.11.14 -process-type:main -handler-pipe:\\.\pipe\crashpad_7836_CZBMSBZHYJMTNGGA4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /restartexplorer4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=gpu-process --crashpad-handler-ipc-pipe-name="\\.\pipe\crashpad_7836_CZBMSBZHYJMTNGGA" --crashpad-annotations="product_name:desktop_client,buildid:main,buildno:Dropbox-win-264.4.3421,platform:win,platform_version:11 26100" --user-data-dir="C:\Users\Admin\AppData\Roaming\Dropbox" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5404,i,13078006384217936772,14954274119274586663,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:24⤵
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Dropbox" --standard-schemes=dbx-local --enable-sandbox --secure-schemes=dbx-local,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=dbx-local,sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=dbx-local --field-trial-handle=5404,i,13078006384217936772,14954274119274586663,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:114⤵
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Dropbox" --standard-schemes=dbx-local --enable-sandbox --secure-schemes=dbx-local,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=dbx-local,sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=dbx-local --app-path="C:\Program Files (x86)\Dropbox\Client\264.4.3421\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786588764403681 --launch-time-ticks=708105200 --field-trial-handle=5404,i,13078006384217936772,14954274119274586663,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:14⤵
-
-
C:\Program Files (x86)\Dropbox\Client\Dropbox.exe"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Dropbox" --standard-schemes=dbx-local --enable-sandbox --secure-schemes=dbx-local,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=dbx-local,sentry-ipc --fetch-schemes=sentry-ipc --streaming-schemes=dbx-local --app-path="C:\Program Files (x86)\Dropbox\Client\264.4.3421\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786588764403681 --launch-time-ticks=708197012 --field-trial-handle=5404,i,13078006384217936772,14954274119274586663,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=9904 /prefetch:14⤵
-
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
4Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
4Change Default File Association
1Component Object Model Hijacking
1Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
e5952cc.rbs
264.4.3421.manifest
StoreLogo.contrast-black_scale-100.png
StoreLogo.contrast-black_scale-125.png
StoreLogo.contrast-black_scale-150.png
StoreLogo.contrast-black_scale-200.png
StoreLogo.contrast-black_scale-400.png
StoreLogo.contrast-white_scale-100.png
StoreLogo.contrast-white_scale-125.png
StoreLogo.contrast-white_scale-150.png
StoreLogo.contrast-white_scale-200.png
StoreLogo.contrast-white_scale-400.png
StoreLogo.scale-100.png
StoreLogo.scale-125.png
StoreLogo.scale-150.png
StoreLogo.scale-200.png
StoreLogo.scale-400.png
TileSmall.contrast-black.png
TileSmall.contrast-black_scale-125.png
TileSmall.contrast-black_scale-150.png
TileSmall.contrast-black_scale-200.png
TileSmall.contrast-black_scale-400.png
TileSmall.contrast-white.png
TileSmall.contrast-white_scale-100.png
TileSmall.contrast-white_scale-125.png
TileSmall.contrast-white_scale-150.png
TileSmall.contrast-white_scale-200.png
TileSmall.contrast-white_scale-400.png
TileSmall.png
TileSmall.scale-125.png
TileSmall.scale-150.png
TileSmall.scale-200.png
TileSmall.scale-400.png
TinyTile.contrast-black.png
TinyTile.contrast-black_scale-125.png
TinyTile.contrast-black_scale-150.png
TinyTile.contrast-black_scale-200.png
TinyTile.contrast-black_scale-400.png
TinyTile.contrast-white.png
TinyTile.contrast-white_scale-125.png
TinyTile.contrast-white_scale-150.png
TinyTile.contrast-white_scale-200.png
TinyTile.contrast-white_scale-400.png
TinyTile.png
TinyTile.scale-125.png
TinyTile.scale-150.png
TinyTile.scale-200.png
TinyTile.scale-400.png
backup.png
backup.targetsize-128.png
backup.targetsize-16.png
backup.targetsize-24.png
backup.targetsize-32.png
backup.targetsize-48.png
backup.targetsize-64.png
binder.png
binder.targetsize-128.png
binder.targetsize-16.png
binder.targetsize-24.png
binder.targetsize-32.png
binder.targetsize-48.png
binder.targetsize-64.png
external_drive.png
external_drive.targetsize-128.png
external_drive.targetsize-16.png
external_drive.targetsize-24.png
external_drive.targetsize-32.png
external_drive.targetsize-48.png
external_drive.targetsize-64.png
logo.contrast-black.png
logo.contrast-black_scale-125.png
logo.contrast-black_scale-150.png
logo.contrast-black_scale-200.png
logo.contrast-black_scale-400.png
logo.contrast-white.png
logo.contrast-white_scale-125.png
logo.contrast-white_scale-150.png
logo.contrast-white_scale-200.png
logo.contrast-white_scale-400.png
logo.png
logo.scale-125.png
logo.scale-150.png
logo.scale-200.png
logo.scale-400.png
logo.targetsize-16.png
logo.targetsize-16_altform-unplated_contrast-black.png
logo.targetsize-16_altform-unplated_contrast-white.png
logo.targetsize-20.png
logo.targetsize-20_altform-unplated_contrast-black.png
logo.targetsize-20_altform-unplated_contrast-white.png
logo.targetsize-24.png
logo.targetsize-24_altform-unplated_contrast-black.png
logo.targetsize-24_altform-unplated_contrast-white.png
logo.targetsize-256.png
logo.targetsize-256_altform-unplated_contrast-black.png
logo.targetsize-256_altform-unplated_contrast-white.png
logo.targetsize-30.png
logo.targetsize-30_altform-unplated_contrast-black.png
logo.targetsize-30_altform-unplated_contrast-white.png
logo.targetsize-32.png
logo.targetsize-32_altform-unplated_contrast-black.png
logo.targetsize-32_altform-unplated_contrast-white.png
logo.targetsize-36.png
logo.targetsize-36_altform-unplated_contrast-black.png
logo.targetsize-36_altform-unplated_contrast-white.png
logo.targetsize-40.png
logo.targetsize-40_altform-unplated_contrast-black.png
logo.targetsize-40_altform-unplated_contrast-white.png
logo.targetsize-48.png
logo.targetsize-48_altform-unplated_contrast-black.png
logo.targetsize-48_altform-unplated_contrast-white.png
logo.targetsize-60.png
logo.targetsize-60_altform-unplated_contrast-black.png
logo.targetsize-60_altform-unplated_contrast-white.png
logo.targetsize-64.png
logo.targetsize-64_altform-unplated_contrast-black.png
logo.targetsize-64_altform-unplated_contrast-white.png
logo.targetsize-72.png
logo.targetsize-72_altform-unplated_contrast-black.png
logo.targetsize-72_altform-unplated_contrast-white.png
logo.targetsize-80.png
logo.targetsize-80_altform-unplated_contrast-black.png
logo.targetsize-80_altform-unplated_contrast-white.png
logo.targetsize-96.png
logo.targetsize-96_altform-unplated_contrast-black.png
logo.targetsize-96_altform-unplated_contrast-white.png
paper.png
paper.targetsize-128.png
paper.targetsize-16.png
paper.targetsize-24.png
paper.targetsize-32.png
paper.targetsize-48.png
paper.targetsize-64.png
papert.png
papert.targetsize-128.png
papert.targetsize-16.png
papert.targetsize-24.png
papert.targetsize-28.png
papert.targetsize-32.png
papert.targetsize-48.png
papert.targetsize-512.png
papert.targetsize-64.png
passwords.png
passwords.targetsize-128.png
passwords.targetsize-16.png
passwords.targetsize-24.png
passwords.targetsize-32.png
passwords.targetsize-48.png
passwords.targetsize-64.png
web.png
web.targetsize-128.png
web.targetsize-16.png
web.targetsize-24.png
web.targetsize-32.png
web.targetsize-48.png
web.targetsize-64.png
DropboxElevationService.exe
DropboxOfficeAddIn.14.dll
DropboxOfficeAddIn64.14.dll
DropboxThumbnailGenerator.exe
DropboxUpdateClient.exe
DropboxUpdateProxy32.exe
apex.node
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
chrome_100_percent.pak
chrome_200_percent.pak
concrt140.dll
d3dcompiler_47.dll
dbx-canary.sys
dbx.inf
dbxsvc.exe
dropbox.cat
dropbox_core_tprt.node
dropbox_crashpad.dll
dropbox_sqlite_ext.dll
dropbox_tprt.dll
ffmpeg.dll
icudtl.dat
dropboxstatus-busy.png
dropboxstatus-cam.png
dropboxstatus-connecting.png
dropboxstatus-idle.png
dropboxstatus-longnotification.png
dropboxstatus-notification.png
dropboxstatus-pause.png
dropboxstatus-quitting.png
dropboxstatus-shortnotification.png
dropboxstatus-snooze.png
dropboxstatus-x.png
dropboxstatus-busy.png
dropboxstatus-cam.png
dropboxstatus-connecting.png
dropboxstatus-idle.png
dropboxstatus-longnotification.png
dropboxstatus-notification.png
dropboxstatus-pause.png
dropboxstatus-shortnotification.png
dropboxstatus-snooze.png
dropboxstatus-x.png
dropboxstatus-busy.png
dropboxstatus-cam.png
dropboxstatus-idle.png
dropboxstatus-longnotification.png
dropboxstatus-notification.png
dropboxstatus-pause.png
dropboxstatus-shortnotification.png
dropboxstatus-snooze.png
dropboxstatus-x.png
splashOfficeAddin.png
splashScreenshots.png
splashCameraOutOfSpace.png
splashCameraUploadsPTPError.png
splashCameraWelcome.png
libEGL.dll
libGLESv2.dll
libffi-8.dll
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
vi.pak
zh-CN.pak
zh-TW.pak
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
_bowbow.cp311-win_amd64.pyd
_cffi_backend.cp311-win_amd64.pyd
_win32sysloader.pyd
_yappi.cp311-win_amd64.pyd
advapi32_native.pyd
allocator_metrics.cp311-win_amd64.pyd
apex._apex.pyd
cloud_files_utils.cp311-win_amd64.pyd
cpuid_native.pyd
crashpad_native.pyd
cryptography.hazmat.bindings._rust.pyd
dbghelp_native.pyd
fastpath.cp311-win_amd64.pyd
fs_api_python.cp311-win_amd64.pyd
gdi32_native.pyd
gdiplus_native.pyd
google._upb._message.cp311-win_amd64.pyd
kernel32_native.pyd
mmapfile.pyd
ntdll_native.pyd
nucleus_python.cp311-win_amd64.pyd
progresstaskdialog_native.pyd
psutil._psutil_windows.pyd
shell32_native.pyd
shlwapi_native.pyd
taskdialog_native.pyd
timer_native.pyd
tornado.speedups.pyd
tprt.cp311-win_amd64.pyd
user32_native.pyd
win32api.pyd
win32clipboard.pyd
win32com.shell.shell.pyd
win32event.pyd
win32evtlog.pyd
win32file.pyd
win32gui.pyd
win32job.pyd
win32pipe.pyd
win32process.pyd
win32profile.pyd
win32security.pyd
win32service.pyd
win32ts.pyd
windisplaytoast_native.pyd
winenumhandles_native.pyd
winhttp_native.pyd
wininfinitedrivers_native.pyd
wininfinitedrivers_wow64_native.pyd
wininternetcheckapi.cp311-win_amd64.pyd
winrpcserver_native.pyd
winscreenshot_native.pyd
winshell_native.pyd
winverifysignature_native.pyd
python311.dll
pythoncom311.dll
pywintypes311.dll
resources.pak
box.ico
box_32.png
default_app.asar
local_views.zip
ucrtbase.dll
v8_context_snapshot.bin
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
Dropbox.VisualElementsManifest.xml
DropboxUninstaller.exe
Dropbox.msix
DropboxExt.96.0.dll
DropboxExt64.96.0.dll
resources.pri
resources.pri
@PaxHeader
DropboxCleanup.exe
DropboxCrashHandler.exe
DropboxUpdate.exe
DropboxUpdateBroker.exe
DropboxUpdateHelper.msi
DropboxUpdateOnDemand.exe
goopdate.dll
goopdateres_da.dll
goopdateres_de.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_es.dll
goopdateres_fr.dll
goopdateres_id.dll
goopdateres_it.dll
goopdateres_ja.dll
goopdateres_ko.dll
goopdateres_ms.dll
goopdateres_nl.dll
goopdateres_no.dll
goopdateres_pl.dll
goopdateres_pt-BR.dll
goopdateres_ru.dll
goopdateres_sv.dll
goopdateres_th.dll
goopdateres_uk.dll
goopdateres_zh-CN.dll
goopdateres_zh-TW.dll
npDropboxUpdate3.dll
psmachine.dll
psuser.dll
DropboxClient_264.4.3421.x64.exe
DropboxUnzipper_264.4.3421.x64.exe
InstallerMetadata
Resources.resw
dropbox_electron_core.dll
Dropbox.lnk
Dropbox.lnk~RFe5af5ea.TMP
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
__PSScriptPolicyTest_xk1ci4z1.erx.ps1
System.dll
index
data_1
data_0
data_2
data_3
CURRENT
default.exc
dism.log
dbx.inf_amd64_2758e227d1ac3410.ini
DropboxUpdateTaskMachineUA.job
memory/2540-5068-0x0000000008AB0000-0x0000000008B7C000-memory.dmp
memory/3364-4971-0x00007FFC1D320000-0x00007FFC1D321000-memory.dmp
memory/3364-4970-0x00007FFC1C2D0000-0x00007FFC1C2D1000-memory.dmp
memory/5032-69-0x0000000003380000-0x0000000003381000-memory.dmp
memory/5836-4637-0x000001FB98C40000-0x000001FB98CBC000-memory.dmp
memory/6356-4818-0x0000014401A40000-0x0000014401A60000-memory.dmp
memory/6356-4822-0x0000014401C80000-0x0000014401CA0000-memory.dmp
memory/6356-4791-0x00000144001E0000-0x00000144002E0000-memory.dmp
memory/6356-4836-0x00000144142E0000-0x0000014414300000-memory.dmp
memory/6356-4819-0x0000014414000000-0x0000014414100000-memory.dmp
memory/6356-4790-0x00000144001E0000-0x00000144002E0000-memory.dmp
memory/7200-4674-0x0000020D4CF20000-0x0000020D4CF28000-memory.dmp
memory/7200-4684-0x0000020D4D530000-0x0000020D4D558000-memory.dmp
memory/7200-4675-0x0000020D4D390000-0x0000020D4D3B6000-memory.dmp
memory/7200-4681-0x0000020D4D360000-0x0000020D4D36A000-memory.dmp
memory/7200-4673-0x0000020D4CEF0000-0x0000020D4CEFA000-memory.dmp
memory/7200-4672-0x0000020D4CEE0000-0x0000020D4CEE6000-memory.dmp
memory/7200-4670-0x0000020D4D3D0000-0x0000020D4D3FA000-memory.dmp
memory/7200-4671-0x0000020D4CD80000-0x0000020D4CD88000-memory.dmp
memory/7200-4669-0x0000020D4CF00000-0x0000020D4CF1A000-memory.dmp
memory/7200-4668-0x0000020D4D570000-0x0000020D4D774000-memory.dmp
memory/7200-4665-0x0000020D4D150000-0x0000020D4D202000-memory.dmp
memory/7200-4664-0x0000020D4CEE0000-0x0000020D4CEFE000-memory.dmp
memory/7200-4661-0x0000020D4CD40000-0x0000020D4CD62000-memory.dmp