Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\dropboxupdatetaskmachinecore.job
- <SYSTEM32>\tasks\dropboxupdatetaskmachinecore
- %WINDIR%\tasks\dropboxupdatetaskmachineua.job
- <SYSTEM32>\tasks\dropboxupdatetaskmachineua
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\dbupdate] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\dbupdate] 'ImagePath' = '"%ProgramFiles(x86)%\Dropbox\Update\DropboxUpdate.exe" /svc'
- [HKLM\System\CurrentControlSet\Services\dbupdatem] 'ImagePath' = '"%ProgramFiles(x86)%\Dropbox\Update\DropboxUpdate.exe" /medsvc'
Creates the following services
- 'dbupdate' "%ProgramFiles(x86)%\Dropbox\Update\DropboxUpdate.exe" /svc
- 'dbupdatem' "%ProgramFiles(x86)%\Dropbox\Update\DropboxUpdate.exe" /medsvc
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\dropbox\temp\gut8a07.tmp
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-02-938-2952
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxcleanup.exe
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxupdateondemand.exe
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxupdatebroker.exe
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\npdropboxupdate3.dll
- %ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\psmachine.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\psuser.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxupdatehelper.msi
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_zh-tw.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_zh-cn.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_uk.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_th.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_sv.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_ru.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_pt-br.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_pl.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_no.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_nl.dll
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-593-2088
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-673-2088
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-843-2088
- %WINDIR%\temp\tarc812.tmp
- %WINDIR%\temp\cabc811.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\e573cdf4c6d731d56a665145182fd759_5a9fe11e8b6335fda91281200971e038
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\e573cdf4c6d731d56a665145182fd759_5a9fe11e8b6335fda91281200971e038
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\d7c5c79d5ea2eaa218d5c63883951605
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\d7c5c79d5ea2eaa218d5c63883951605
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\temp\tar6e5d.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\temp\cab6e5c.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\1801a0bff52c676e5f51ca71c5350277
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\1801a0bff52c676e5f51ca71c5350277
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-31-185-1780
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-30-851-1080
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-30-326-1780
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-30-017-2956
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-29-323-312
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-993-2088
- %WINDIR%\temp\cabca35.tmp
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_ms.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_ko.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_ja.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_ja.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_it.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_id.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_fr.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_es-419.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_es.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_en.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_de.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_da.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\psuser.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\psmachine.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxupdateondemand.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxupdatebroker.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxupdatehelper.msi
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\npdropboxupdate3.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdate.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxcrashhandler.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxupdate.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\@paxheader
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_ko.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_ms.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_nl.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_no.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_id.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_fr.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_es-419.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_es.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_en.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_de.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_da.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxcrashhandler.exe
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdate.dll
- %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-45-53-938-312
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\dropboxupdate.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxcleanup.exe
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_zh-tw.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_zh-cn.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_uk.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_th.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_sv.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_ru.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_pt-br.dll
- %ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\goopdateres_pl.dll
- %ProgramFiles(x86)%\dropbox\update\1.3.911.1\goopdateres_it.dll
- %WINDIR%\temp\tarca36.tmp
Deletes the following files
- %WINDIR%\temp\cab6e5c.tmp
- %WINDIR%\temp\tar6e5d.tmp
- %WINDIR%\temp\cabc811.tmp
- %WINDIR%\temp\tarc812.tmp
- %WINDIR%\temp\cabca35.tmp
- %WINDIR%\temp\tarca36.tmp
Moves the following files
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-02-938-2952 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-02-938-2952-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-673-2088 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-673-2088-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-843-2088 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-843-2088-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-993-2088 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-993-2088-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-593-2088 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-28-593-2088-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-29-323-312 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-29-323-312-finished
- from %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-30-017-2956 to %ALLUSERSPROFILE%\dropbox\update\log\dropboxupdate.log-2024-12-01-19-46-30-017-2956-finished
Network activity
Connects to
- 'cl####.dropbox.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'cl####.dropbox.com':443
UDP
- DNS ASK cl####.dropbox.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\dropbox\temp\gum8a06.tmp\dropboxupdate.exe' /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dr...
- '%ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe' /regsvc
- '%ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe' /regserver
- '%ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVpVcDVjbFpwY0U5TVV6ZFBlazB0VEhvd2VGSnpiRWwzYzJwQmQzTnFVVEowVkVGNWMySkJkMDVpWTNkTlJFMHpUbFJ...
- '%ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe' /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiZ...
- '%ProgramFiles(x86)%\dropbox\update\dropboxupdate.exe' /svc
