CmdID

CmdID / Files

DropboxUpdate.exe

Dropbox Update file version info

Program on Windows 1 known copy with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DropboxUpdate.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Dropbox\Update\
Signed byDropbox
ProductDropbox Update, Dropbox, Inc.
DescriptionDropbox Update

1 known copy

1.3.27.73 · C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe · signed by Dropbox

47839789332aaf8861f7731bf2d3fbb5e0991ea0d0b457bb4c8c1784f76c73dc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names DropboxUpdate.exe in 3 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.