wiremop.blogg.se

"DropboxUpdate.exe" called "OpenService" to access the "dbupdate" service requesting "SERVICE_QUERY_CONFIG" (0X1) access rights "DropboxUpdate.exe" called "OpenService" to access the "dbupdatem" service "DropboxUpdate.exe" called "OpenService" to access the "Schedule" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights "DropboxUpdate.exe" called "OpenService" to access the "gpsvc" service "DropboxUpdate.exe" called "OpenService" to access the "ServicesActive" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights Spawned process "DropboxUpdate.exe" with commandline "/unregsvc" ( Show Process) Spawned process "DropboxUpdate.exe" with commandline "/unregserver" ( Show Process) Spawned process "DropboxUpdate.exe" with commandline "/report "%PROGRAMFILES%\Dropbox\CrashReports\d159a0b0-bf61-489d-8aa5-b0823dcd627c.dmp" /machine" ( Show Process) Spawned process "DropboxUpdate.exe" with commandline "/installsource taggedmi /install "appguid="" ( Show Process) Malicious artifacts seen in the context of a contacted host "DropboxUpdate.exe" wrote 52 bytes to a remote process "C:\Program Files\Dropbox\Update\DropboxUpdate.exe" (Handle: 604) "DropboxUpdate.exe" wrote 32 bytes to a remote process "C:\Program Files\Dropbox\Update\DropboxUpdate.exe" (Handle: 604)

"DropboxUpdate.exe" wrote 4 bytes to a remote process "C:\Program Files\Dropbox\Update\DropboxUpdate.exe" (Handle: 604) "DropboxUpdate.exe" wrote 1500 bytes to a remote process "C:\Program Files\Dropbox\Update\DropboxUpdate.exe" (Handle: 604) "" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\GUM3D2A.tmp\DropboxUpdate.exe" (Handle: 132) "" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\GUM3D2A.tmp\DropboxUpdate.exe" (Handle: 132) "" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\GUM3D2A.tmp\DropboxUpdate.exe" (Handle: 132) "" wrote 1500 bytes to a remote process "%TEMP%\GUM3D2A.tmp\DropboxUpdate.exe" (Handle: 132)