Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/04/2026, 04:57
General
- Target 2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
- Size 1.4MB
- Sample260423-flcsfabt6x
- SHA256 65521b0973be6e83d0f6a8a1cb93379b4609328f82c73e3609309205cc465eff
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Family: Xred
Xred is backdoor written in Delphi.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 24 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
- Drops file in System32 directory 10 IoCs
- Drops file in Program Files directory 32 IoCs
- Drops file in Windows directory 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 6 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM4551.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM4551.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaWZRIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjcxOUJBN0YtRTE1OS00Mzk0LThBMjYtMzAzQTg4NzdDNkU3fSIgdXNlcmlkPSJ7OUQ5ODQzRUEtNEUyMS00QTg5LTlDQjgtQTY2QjYwQTk5MDY3fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezNGNzY2MTQ5LTdGQzQtNEZBNi1CRDNFLTQ0QkI0Nzk5NjI0Nn0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{B719BA7F-E159-4394-8A26-303A8877C6E7}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\GUM4551.tmp\DropboxUpdate.exe"C:\Users\Admin\AppData\Local\Temp\GUM4551.tmp\DropboxUpdate.exe" /unregsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM4AFE.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM4AFE.tmp\DropboxUpdate.exe InjUpdate "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM51E4.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM51E4.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaWZRIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEE2NTFFRUQtQkJERC00RDY4LUJCQjItQjc0MzQwMjYyQjUwfSIgdXNlcmlkPSJ7OUQ5ODQzRUEtNEUyMS00QTg5LTlDQjgtQTY2QjYwQTk5MDY3fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezk4MkY3QUNBLUM4QUYtNDVFRS1CQjFGLUIwQUU2RjAwRDFBMX0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIxLjMuNTAzLjEiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MjE5Njk2IiBleHRyYWNvZGUxPSIxMiIvPjwvYXBwPjxhcHAgYXBwaWQ9IntDQzQ2MDgwRS00QzMzLTQ5ODEtODU5QS1CQkEyRjc4MEYzMUV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MjE5Njk2IiBleHRyYWNvZGUxPSIxMiIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaUxDSnlaWEYxWlhOMFgzTmxjWFZsYm1ObElqb3dmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjUwMy4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0I3MTlCQTdGLUUxNTktNDM5NC04QTI2LTMwM0E4ODc3QzZFN30iIHVzZXJpZD0iezlEOTg0M0VBLTRFMjEtNEE4OS05Q0I4LUE2NkI2MEE5OTA2N30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntENjE5MkE2Ri1ERDdCLTRBRjUtQTY5My04OTVDQjk2M0Q4RTR9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4yIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4NzkiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
e58534e.rbs
e585352.rbs
goopdateres_da.dll
goopdateres_es.dll
goopdateres_fr.dll
goopdateres_it.dll
goopdateres_ko.dll
goopdateres_nl.dll
goopdateres_pl.dll
goopdateres_ru.dll
goopdateres_th.dll
goopdateres_zh-TW.dll
psuser.dll
Synaptics.exe
._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
E8885E00
DropboxCrashHandler.exe
DropboxUpdate.exe
DropboxUpdateBroker.exe
DropboxUpdateHelper.msi
DropboxUpdateOnDemand.exe
goopdate.dll
goopdateres_de.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_id.dll
goopdateres_ja.dll
goopdateres_ms.dll
goopdateres_no.dll
goopdateres_pt-BR.dll
goopdateres_sv.dll
goopdateres_uk.dll
goopdateres_zh-CN.dll
npDropboxUpdate3.dll
psmachine.dll
DropboxUpdateTaskMachineUA.job
memory/864-789-0x00000000016D0000-0x00000000016D7000-memory.dmp
memory/864-788-0x0000000000E40000-0x0000000000EBB000-memory.dmp
memory/1060-715-0x0000000000870000-0x00000000008EB000-memory.dmp
memory/1544-613-0x0000000000BD0000-0x0000000000C4B000-memory.dmp
memory/1668-781-0x00000000011C0000-0x000000000123B000-memory.dmp
memory/1668-782-0x0000000003770000-0x0000000003829000-memory.dmp
memory/1740-634-0x0000000002FD0000-0x0000000003089000-memory.dmp
memory/1740-620-0x0000000002FD0000-0x0000000003089000-memory.dmp
memory/1740-619-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/1740-633-0x0000000000A00000-0x0000000000A7B000-memory.dmp
memory/1884-765-0x0000000001530000-0x00000000015AB000-memory.dmp
memory/1884-621-0x0000000001530000-0x00000000015AB000-memory.dmp
memory/1896-753-0x0000000001390000-0x000000000140B000-memory.dmp
memory/1896-754-0x0000000001270000-0x0000000001277000-memory.dmp
memory/2300-618-0x0000000001340000-0x00000000013BB000-memory.dmp
memory/2300-636-0x0000000001340000-0x00000000013BB000-memory.dmp
memory/2352-626-0x0000000003630000-0x000000000364F000-memory.dmp
memory/2352-761-0x00000000036A0000-0x0000000003759000-memory.dmp
memory/2352-745-0x00000000033E0000-0x00000000033E7000-memory.dmp
memory/2352-760-0x0000000000F00000-0x0000000000F7B000-memory.dmp
memory/2352-763-0x00000000033E0000-0x00000000033E7000-memory.dmp
memory/2352-624-0x00000000036A0000-0x0000000003759000-memory.dmp
memory/2352-622-0x0000000000F00000-0x0000000000F7B000-memory.dmp
memory/2352-762-0x0000000003630000-0x000000000364F000-memory.dmp
memory/2564-0-0x0000000002220000-0x0000000002221000-memory.dmp
memory/2564-163-0x00000000006A0000-0x0000000000715000-memory.dmp
memory/2564-162-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2564-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2672-617-0x0000000000690000-0x0000000000705000-memory.dmp
memory/2672-728-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2672-616-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2672-730-0x00000000028F0000-0x00000000028F7000-memory.dmp
memory/2672-729-0x0000000000690000-0x0000000000705000-memory.dmp
memory/2720-546-0x0000000000640000-0x00000000006BB000-memory.dmp
memory/3244-603-0x00000000009A0000-0x0000000000A1B000-memory.dmp
memory/3248-600-0x0000000001350000-0x00000000013CB000-memory.dmp
memory/3788-629-0x0000000001470000-0x00000000014EB000-memory.dmp
memory/3788-630-0x0000000001850000-0x0000000001857000-memory.dmp
memory/3932-750-0x00000221ECF20000-0x00000221ECF75000-memory.dmp
memory/3932-776-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-637-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-639-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-638-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-780-0x00000221ECF20000-0x00000221ECF75000-memory.dmp
memory/3932-643-0x00007FFE03590000-0x00007FFE035A0000-memory.dmp
memory/3932-642-0x00007FFE03590000-0x00007FFE035A0000-memory.dmp
memory/3932-641-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-777-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-640-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-779-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/3932-778-0x00007FFE05E50000-0x00007FFE05E60000-memory.dmp
memory/4292-551-0x0000000000400000-0x0000000000560000-memory.dmp
memory/4292-552-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/4420-628-0x000002664AE50000-0x000002664AE5C000-memory.dmp
memory/4420-746-0x000002664A520000-0x000002664A575000-memory.dmp
memory/4420-627-0x000002664A520000-0x000002664A575000-memory.dmp
memory/4648-785-0x0000000002E60000-0x0000000002E7F000-memory.dmp
memory/4648-784-0x0000000002050000-0x0000000002057000-memory.dmp
memory/4648-783-0x0000000000C30000-0x0000000000CAB000-memory.dmp
memory/4648-795-0x0000000002050000-0x0000000002057000-memory.dmp
memory/4648-794-0x0000000000C30000-0x0000000000CAB000-memory.dmp
memory/5096-727-0x0000000002E30000-0x0000000002EE9000-memory.dmp
memory/5096-614-0x0000000000900000-0x000000000097B000-memory.dmp
memory/5096-615-0x0000000002E30000-0x0000000002EE9000-memory.dmp
memory/5096-768-0x0000000002E30000-0x0000000002EE9000-memory.dmp
memory/5096-769-0x00000000030F0000-0x000000000310F000-memory.dmp