Analysis
- max time kernel
149s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 04:57
General
- Target 2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
- Size 1.4MB
- Sample260423-flcsfabt6x
- SHA256 65521b0973be6e83d0f6a8a1cb93379b4609328f82c73e3609309205cc465eff
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Family: Xred
Xred is backdoor written in Delphi.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 24 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
- Drops file in System32 directory 10 IoCs
- Drops file in Program Files directory 32 IoCs
- Drops file in Windows directory 18 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 9 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM43F9.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM43F9.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaWZRIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTAyNkYyQzItQjRGRi00MTI1LUI2NzctRUZCMDBCNEEwODhEfSIgdXNlcmlkPSJ7NEY1QkM1OEItNzYzOS00RTdGLTkzNkItRjVCOTQ4NDNDNzMyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezg4NjAyQ0Y3LTZBRDktNDIwRi05Qjk3LUYxODI4RTc0MTBFRX0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{A026F2C2-B4FF-4125-B677-EFB00B4A088D}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM487E.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM487E.tmp\DropboxUpdate.exe InjUpdate "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GUM4E98.tmp\DropboxUpdate.exeC:\Users\Admin\AppData\Local\Temp\GUM4E98.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKeXJWa29zTGNtSUw4blBUczFUc2xKUXFpdzBjZ3NMc0hEeUt5b3VDUElMOFRKTXlrdkpLUTlQRGpGMVNmSDBNX0hRTXpRek5yVzBOTEEwTjFEU1VWQXFUaTB1enN6UGk4OU1BV28yTmpBMU5ESTFNRFFIU2hzYm1SbWJHQmxhbUFOVlcxaFlXaGdZbUpzYW1KdVlHQmlhMWdJQURpd2dBQX5-QE1FVEEifQ"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Indicator Removal: Clear Persistence
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaWZRIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNTAzLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTQzQjY5OEQtQkYzNi00NkIxLUI0RTYtMzI2RjUxMjVBNDZGfSIgdXNlcmlkPSJ7NEY1QkM1OEItNzYzOS00RTdGLTkzNkItRjVCOTQ4NDNDNzMyfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezMwMzhDNjU0LURBMkItNEY1QS1CQTk2LTY0QUQ1MkU4Mzg4NX0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjIiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIxLjMuNTAzLjEiIG5leHR2ZXJzaW9uPSIxLjMuNTAzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MjE5Njk2IiBleHRyYWNvZGUxPSIxMiIvPjwvYXBwPjxhcHAgYXBwaWQ9IntDQzQ2MDgwRS00QzMzLTQ5ODEtODU5QS1CQkEyRjc4MEYzMUV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MjE5Njk2IiBleHRyYWNvZGUxPSIxMiIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\GUM4E98.tmp\DropboxUpdate.exe"C:\Users\Admin\AppData\Local\Temp\GUM4E98.tmp\DropboxUpdate.exe" /unregsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktlWEpXYTI5elRHTnRTVXc0YmxCVWN6RlVjMnhLVVhGcGR6QmpaM05NYzBoRWVVdDViM1ZEVUVsTU9GUktUWGxyZGtwTFVUbFFSR3BHTVZObVNEQk5YMGhSVFhwUmVrNXlWekJPVEVFd1RqRkVVMVZXUVhGVWFUQjFlbk42VUdrNE9VMUJWMjh5VG1wQk1VNUVTVEZOUkZGSVUyaHpZbTFTYldKSFFteGhiVUZPVmxjeGFGbFhhR2RaYlVwellXMUtkVmxIUW1saE1XZEpRVVJwZDJkQlFYNS1RRTFGVkVFaUxDSnlaWEYxWlhOMFgzTmxjWFZsYm1ObElqb3dmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjUwMy4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0EwMjZGMkMyLUI0RkYtNDEyNS1CNjc3LUVGQjAwQjRBMDg4RH0iIHVzZXJpZD0iezRGNUJDNThCLTc2MzktNEU3Ri05MzZCLUY1Qjk0ODQzQzczMn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBNjYzOEE3RC04Mjg0LTRDNzQtQjFDOC0zNUI0QUUwNzYwRkN9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4yIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4NzkiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
e585590.rbs
e585594.rbs
DropboxUpdateHelper.msi
goopdateres_da.dll
goopdateres_de.dll
goopdateres_es.dll
goopdateres_fr.dll
goopdateres_it.dll
goopdateres_ja.dll
goopdateres_ms.dll
goopdateres_nl.dll
goopdateres_no.dll
goopdateres_pt-BR.dll
goopdateres_sv.dll
goopdateres_uk.dll
goopdateres_zh-TW.dll
psmachine.dll
Synaptics.exe
._cache_2026-04-23_83fec6fe5769d7f7655d0087d1cd15d0_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
C9585E00
DropboxCrashHandler.exe
DropboxUpdate.exe
DropboxUpdateBroker.exe
DropboxUpdateOnDemand.exe
goopdate.dll
goopdateres_en.dll
goopdateres_es-419.dll
goopdateres_id.dll
goopdateres_ko.dll
goopdateres_pl.dll
goopdateres_ru.dll
goopdateres_th.dll
goopdateres_zh-CN.dll
npDropboxUpdate3.dll
psuser.dll
jAeldadD.xlsm
DropboxUpdateTaskMachineUA.job
memory/688-829-0x00000000031C0000-0x00000000037C2000-memory.dmp
memory/1040-712-0x0000010DDDF90000-0x0000010DDE03E000-memory.dmp
memory/1040-412-0x00007FF8A3090000-0x00007FF8A30A0000-memory.dmp
memory/1040-431-0x0000010D9DF80000-0x0000010D9DF90000-memory.dmp
memory/1040-410-0x00007FF8A3090000-0x00007FF8A30A0000-memory.dmp
memory/1040-381-0x00007FF8A3090000-0x00007FF8A30A0000-memory.dmp
memory/1040-411-0x00007FF8A3090000-0x00007FF8A30A0000-memory.dmp
memory/1040-490-0x00007FF8A0610000-0x00007FF8A0620000-memory.dmp
memory/1040-480-0x00007FF8A0610000-0x00007FF8A0620000-memory.dmp
memory/1040-432-0x00007FF8A3090000-0x00007FF8A30A0000-memory.dmp
memory/1728-833-0x0000000002E70000-0x0000000002E7B000-memory.dmp
memory/1728-823-0x0000000002290000-0x0000000002892000-memory.dmp
memory/1728-723-0x0000000002E70000-0x0000000002E7B000-memory.dmp
memory/1728-724-0x00000000035D0000-0x000000000361B000-memory.dmp
memory/1728-834-0x0000000002E50000-0x0000000002E58000-memory.dmp
memory/1728-832-0x0000000002290000-0x0000000002892000-memory.dmp
memory/1728-791-0x0000000003470000-0x0000000003481000-memory.dmp
memory/1728-835-0x0000000003470000-0x0000000003481000-memory.dmp
memory/1728-790-0x0000000002E50000-0x0000000002E58000-memory.dmp
memory/1728-722-0x0000000002290000-0x0000000002892000-memory.dmp
memory/1880-782-0x0000000000D90000-0x0000000000DA5000-memory.dmp
memory/1880-742-0x00000000028A0000-0x0000000002EA2000-memory.dmp
memory/1880-783-0x0000000002870000-0x0000000002878000-memory.dmp
memory/1880-743-0x0000000000D90000-0x0000000000DA5000-memory.dmp
memory/1880-781-0x00000000028A0000-0x0000000002EA2000-memory.dmp
memory/1880-744-0x0000000002870000-0x0000000002878000-memory.dmp
memory/1972-726-0x00000000006A0000-0x00000000006B5000-memory.dmp
memory/1972-725-0x00000000023B0000-0x00000000029B2000-memory.dmp
memory/1972-727-0x0000000000D80000-0x0000000000D88000-memory.dmp
memory/1972-741-0x0000000000D80000-0x0000000000D88000-memory.dmp
memory/1972-740-0x00000000006A0000-0x00000000006B5000-memory.dmp
memory/1972-739-0x00000000023B0000-0x00000000029B2000-memory.dmp
memory/2120-676-0x0000000002690000-0x0000000002C92000-memory.dmp
memory/2372-855-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2372-784-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2372-708-0x00000000009D0000-0x0000000000FD2000-memory.dmp
memory/2372-707-0x0000000000400000-0x0000000000560000-memory.dmp
memory/2604-612-0x0000000002C60000-0x0000000003262000-memory.dmp
memory/3144-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/3144-158-0x0000000000400000-0x0000000000560000-memory.dmp
memory/3144-159-0x0000000000AE0000-0x00000000010E2000-memory.dmp
memory/3144-0-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/3188-764-0x00000000038A0000-0x00000000038AB000-memory.dmp
memory/3188-765-0x00000000062C0000-0x000000000630B000-memory.dmp
memory/3188-763-0x0000000002B90000-0x0000000003192000-memory.dmp
memory/3188-710-0x00000000038A0000-0x00000000038AB000-memory.dmp
memory/3188-711-0x00000000062C0000-0x000000000630B000-memory.dmp
memory/3188-709-0x0000000002B90000-0x0000000003192000-memory.dmp
memory/3304-815-0x0000000002760000-0x0000000002D62000-memory.dmp
memory/3320-557-0x0000000002200000-0x0000000002802000-memory.dmp
memory/3424-558-0x0000000000400000-0x0000000000560000-memory.dmp
memory/3424-559-0x00000000009D0000-0x0000000000FD2000-memory.dmp
memory/3460-760-0x00000000023F0000-0x00000000029F2000-memory.dmp
memory/3460-728-0x00000000023F0000-0x00000000029F2000-memory.dmp
memory/4112-611-0x0000000002DE0000-0x00000000033E2000-memory.dmp
memory/4316-736-0x0000000001120000-0x0000000001128000-memory.dmp
memory/4316-735-0x0000000000D90000-0x0000000000DA5000-memory.dmp
memory/4316-734-0x0000000001610000-0x0000000001C12000-memory.dmp
memory/4656-705-0x0000000002240000-0x0000000002842000-memory.dmp
memory/5044-731-0x0000000002CB0000-0x0000000002CB8000-memory.dmp
memory/5044-730-0x0000000002C80000-0x0000000002C95000-memory.dmp
memory/5044-729-0x0000000001960000-0x0000000001F62000-memory.dmp
memory/5044-757-0x0000000001960000-0x0000000001F62000-memory.dmp
memory/5044-758-0x0000000002C80000-0x0000000002C95000-memory.dmp
memory/5044-759-0x0000000002CB0000-0x0000000002CB8000-memory.dmp