Analysis

  • max time kernel
    55s
  • max time network
    183s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-09-2022 22:17

General

  • Target

    1a58b7f5b3b323ff3d4944be31684aaf25c95c54bcaaa12c8749e86f2caff651.exe

  • Size

    13.6MB

  • MD5

    0cc49b87da744af4c279c847762b6a32

  • SHA1

    50cce1aa680b4dc729364eaa6c0bd9ad9a7272ba

  • SHA256

    1a58b7f5b3b323ff3d4944be31684aaf25c95c54bcaaa12c8749e86f2caff651

  • SHA512

    3e6c0df6c5f6ebdba1eb2e46d6a6f8a71a117a09f51aaf6b72dc3b0abb5767017b4d04bafd99b4e217706ae0f8269d68d8e64c20079fe885b598a9be19137b5f

  • SSDEEP

    393216:SQ/5wdPcRkVrsRoX50us5UN8oLxsxFEUmgThDeajMOp6Vn:SQRwdPcRy1R8UxBsnjyZ

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 26 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a58b7f5b3b323ff3d4944be31684aaf25c95c54bcaaa12c8749e86f2caff651.exe
    "C:\Users\Admin\AppData\Local\Temp\1a58b7f5b3b323ff3d4944be31684aaf25c95c54bcaaa12c8749e86f2caff651.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\thunderbird.exe
      "C:\Users\Admin\AppData\Roaming\Keep Notes Manager\thunderbird.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5080

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\MSVCP140.dll

    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\VCRUNTIME140.dll

    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\blend2d.dll

    Filesize

    1.3MB

    MD5

    27288ee5541ca1f2b9b19139ed4e9d84

    SHA1

    5c6c8cacc363f6d2cc1ce4421b06e45c6e6202ed

    SHA256

    afbdb370f738500773d98aa638206e4892ebbbbab1adffd2a6a146a40bc14733

    SHA512

    3861434bc8cbc09fecc3b14b36355f667c6232354253915ed79d89fccca963aaa694600f41e5a739acab3ae1cc4ec9feceda9dc195b3b3e3247edd37c602f285

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\brotlicommon.dll

    Filesize

    132KB

    MD5

    0e868ec6a67e491d43ca20ed71c8345d

    SHA1

    b45397b8bafa891a04476f7ffa55fb5bba0e57b9

    SHA256

    441039fe954cfb6e3545aeca5d5750b7e3322eb9efc633508cca1dbefb26b24b

    SHA512

    45e6588671c65ef5eb39abd5f6db790bf1bc8414bfa9073cc9cbbd2bdcd6b9f82a4c6ba47a059521836c34c0504b86b6aa51a19a12317084459d6a6c544829b0

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\brotlidec.dll

    Filesize

    42KB

    MD5

    1616310c08ec85ab5f0437fbf82faf84

    SHA1

    c65cb7266cd21f45728097009147596ca08c0a73

    SHA256

    d9fce48811df001c7f8fe60361f1ea270fc37df7aa73a06a853fd102317cf49d

    SHA512

    ddb8a547367cb40d29a5b3ae54edeb157a707d21993b4cbf5f83617d50795fe8c5235e1afe850515f5b3ddd286c5bd704c7a2fec14f5eb6998d4719e79bf9a85

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\bz2.dll

    Filesize

    63KB

    MD5

    37b38a8e9fbc70f3ed962e5720795a04

    SHA1

    171692daf0a136154edde6e22c791d238ae8c1d0

    SHA256

    f004cd4113a8d832fc4a57f0e28a9001c2fddf67b3544590dd36d0f60d0cef8c

    SHA512

    9d34222337bf50122c613f2132346b7dca0df51990921ff0c7372463f0be69a441eab18122c02e1a94c8fcaa71b533dd477282d74dbc769fb490f4d46aba2607

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\dependentlibs.list

    Filesize

    446B

    MD5

    c35d2da6df0f7abb4d0bd534c5d5b6b0

    SHA1

    a4da4ca15d97746796412c2bad3fc8fbea716869

    SHA256

    ce638d544efe50176888e17bfbf78f118dc733ce5c2fee2eb66436ba96341345

    SHA512

    d27f58fb344b2303db2f4a48a153c9f11eec1663020ba8b5b973fd001c4a8c27c11e29a54b6d1913888b4ddf376aa7f45c8218378abe39a64ebdae4feb6b25cc

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\freetype.dll

    Filesize

    554KB

    MD5

    839c270a8ba5444eebddd293c61e6333

    SHA1

    0fcfab6030a91c722aebea4bfd1bcbe2138c71f9

    SHA256

    ac40311bc17fc9eaf16f4aaf08c07d8a256e07aa4af081c9db9b552b56119e6e

    SHA512

    d34c0f4fcd77c70fa131af3ca19ed82a1d991f599ef8bf69295be25618a0c94af859a67cd80d4893ce105559a432202281ea2ee67af352878c69f8438a1e48cd

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\lgpllibs.dll

    Filesize

    41KB

    MD5

    9616551bf5d32b5f09a05c42bfd944bf

    SHA1

    4d9310aea5fb156cb58633baff315164d68661be

    SHA256

    dc204fb1e134ae1600aa60e4fbd8a23fdb9d7ec906f5196ac7f739b8429b2722

    SHA512

    30b18d5ca4e3e9906f3ce519ad07bcb093ff814a7ab437e8626a968e83a93af26f131cd96abe1fedd8db229e4053d688629985c9b490925f94a0bbf9a6889fe7

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\libcm30.dll

    Filesize

    3.1MB

    MD5

    d91500b834eb59e906b64e412413176a

    SHA1

    d92f00dec386af08e6db9ce720b8ec322340fb37

    SHA256

    bb297db241e7adc4b4d894bbcd3cd8b62f619b3e1159733bca8487fd0ee0ce12

    SHA512

    6b9ebb3e47d5ee3a3156ffdda1f817375b22027f624ea89d9da971a7331eca65d544eeb6bfb80b5c6f6dda849e9c32400ef5dabc655f11b24343147b17e6f679

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\libpng16.dll

    Filesize

    162KB

    MD5

    8bb4c17afdeadb4c81da2f407dcb9809

    SHA1

    ce2bb6eddedf31e9dee7e43d4535250da442e852

    SHA256

    1ceae383d27ef1b45d19f7bff2ab8fe02d553c861342ac8c2d6a32f9a6c1b825

    SHA512

    b944a4b1e0e9a3b5418169429810c8933910bcdfe13b87d01027d0a4786ca7ddd44b4540da07a09b9a56a196f7681d31a878b72766991fa3dddc5221bfee82bd

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\mozglue.dll

    Filesize

    603KB

    MD5

    3db516a28e6f57f03f211a97f37f7d40

    SHA1

    2e11e182425bf400d060e372a411f0d122012625

    SHA256

    2cca9bce657a80e3714fdcd2bb4d318b932bb4e967e2efd49c553954665e2bad

    SHA512

    760e8dca2b8160708d5c55781a6c1a9e4835976e240aeac6d842ccf8544fc00cd0be7908dd14a60597051622d61eee3696c10332198b655c697be74a71686e01

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\nss3.dll

    Filesize

    2.2MB

    MD5

    c21fbee0e891e185c3f861ef4cee648c

    SHA1

    1265d1ee99745428d15ab4ee203b33a2d19b509e

    SHA256

    f0dc4d5d21450922d7fa87b5fb6972d8b33d406e8efc56360d7870dc50b48c2b

    SHA512

    92ae80205fbebd4ced39d126e0f283460ad82b0e7bdd38b2300c3f90066a29ba3cebefec048c6502af9bdca86313487beedc4069c0400bb5db99e17b6c163e93

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\page

    Filesize

    1.8MB

    MD5

    b62c77b57a90c8f45749f5f425ebb5df

    SHA1

    bcd53bb0c06f7f534e59d68ff7e1ec428ab56773

    SHA256

    8ced96cdc844c69a869e9db09c0f461e4e1dc8f89213c5bdcaa45a9ae3c4d887

    SHA512

    ccddd03b14c496e675c7bb0bed919256eda2fee1e3a9c7131c1a831ecdbea14c2d01a57be092735c3c5a1bed1df1b30cee2d74b6779bde859498f21243da36d3

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\sqlite3.dll

    Filesize

    771KB

    MD5

    b786b64448ef03245735b099d95f9788

    SHA1

    d222e2ad8763056ffad755be405b62b9c692079c

    SHA256

    c8101feaec9e0abaae417c915e3f545b7e394c9287e3c8548e1c3684e461def8

    SHA512

    2b40aeff70feb6857b586b8f77d27fc7591f6b4e87a6281c09625aad0cc97fd965c35b41b4a0060ff5ed622f30830ba4a4e08c074776b198e78efe4b38222537

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\thunderbird.exe

    Filesize

    352KB

    MD5

    7238412641bb82a88845c355c363e897

    SHA1

    5a64f26adf8078941d7218b247e5728161864486

    SHA256

    e5bbc723a99815cf321ae9bf30f9fce147132c1a1410447d4e9c8da829eedd1c

    SHA512

    97e1304880d8137a9086b5f6d7b8834630d27a0babe552077324c3a04007de669eb314568ad9aea4e497f0910f686a740c9a5b97b5bbf768d774fa023a6f07e2

  • C:\Users\Admin\AppData\Roaming\Keep Notes Manager\zlib1.dll

    Filesize

    76KB

    MD5

    0ac2236d42d8ced5dbd181bf19637783

    SHA1

    59e317e893831615b7d338f3c328de42c3a04f2d

    SHA256

    59281018c70bfec371d593d4bd005f8c52c8a3440d96fdf28ad4881bf3c4d78f

    SHA512

    3c71c2f83110e51c44a6c79efd83490bbc93f022a937d6759cfed103fc250b46a7d895df5d880247381a74642ab8eb6497463202b455f1935d28b24ae0389183

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR619D.tmp

    Filesize

    99KB

    MD5

    2c9676a3167739f36912818acb8e9860

    SHA1

    cd9e5e56cc408c40c45caf49614c26fc7fde39f6

    SHA256

    75fc64a55afa86173947948d78ba5de98dfc35c487166a6682fe71ed5f6f877a

    SHA512

    a6c375511d9d339b889adcca4a95bc23df9e207f86605f6d6d04ab7e211901cdc3012860ed844a5c36737369e01dc70b212f5960d8a662fdc720ad98e1202aa1

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR62E6.tmp

    Filesize

    288KB

    MD5

    122a3741699fb5c0950273245c9dea15

    SHA1

    811f9149e3310a8e6521da156f92f3aaab012145

    SHA256

    f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab

    SHA512

    567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6856.tmp

    Filesize

    35KB

    MD5

    08ad4cd2a940379f1dcdbdb9884a1375

    SHA1

    c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac

    SHA256

    78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8

    SHA512

    f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6895.tmp

    Filesize

    169KB

    MD5

    cf2d7b4de923b25955d96d2e65ce76bc

    SHA1

    8feee81fe77a7649b969d375778d2b78d842cf48

    SHA256

    0912c84ded4670c427db1f405eb68a5763eae8fa0a735abe44eea81be7dc44ea

    SHA512

    d26a0983f0323655eddc48863a409d172a4623bd7ed465b5a4675477938de10127323040da77c80201c3a816315d98cace5194207e22b0a6ac2e65ae6795dc4f

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6932.tmp

    Filesize

    532KB

    MD5

    a6f7a08b0676f0564a51b5c47973e635

    SHA1

    d56f5f9e2580b81717317da6582da9d379426d5b

    SHA256

    5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c

    SHA512

    1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6982.tmp

    Filesize

    72KB

    MD5

    c04970b55bcf614f24ca75b1de641ae2

    SHA1

    52b182caef513ed1c36f28eb45cedb257fa8ce40

    SHA256

    5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80

    SHA512

    a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR69D1.tmp

    Filesize

    14KB

    MD5

    77fe66d74901495f4b41a5918acd02ff

    SHA1

    ce5bbd53152cd5b03df8bcc232a1aea36a012764

    SHA256

    b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522

    SHA512

    cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6B1A.tmp

    Filesize

    14KB

    MD5

    d74aadd701bfacc474c431acab7b9265

    SHA1

    8a2b424d1f949430ddc1faddee3e9ccb79c95de2

    SHA256

    f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d

    SHA512

    0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6CE0.tmp

    Filesize

    366KB

    MD5

    0700f3dbe367287ce10472cffbd3d7d1

    SHA1

    079790389532599ce04fd82c2b89db5e4dedf26c

    SHA256

    77e46a6a8fbc079cdb1d3ee299af36c3d1881d38d93c4e0551f114965cdaf10f

    SHA512

    28eb67d348c8e9e36032d041315b6ee790d2e9021a3a657a7fe33c66ad1f8daa5b3e0833a2a432cb4a4c5795fea5a80a1810440fb441b6f0d56cf0d00d3e0a17

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6D4E.tmp

    Filesize

    74KB

    MD5

    924b90c3d9e645dfad53f61ea4e91942

    SHA1

    65d397199ff191e5078095036e49f08376f9ae4e

    SHA256

    41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322

    SHA512

    76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

  • \Users\Admin\AppData\Local\Temp\BRL00000a6c\BR6D9D.tmp

    Filesize

    150KB

    MD5

    efd81ea220094b0e91630b648d00e731

    SHA1

    226635424baf8146af055908c4c12b0a3faecd4f

    SHA256

    931c52c91ffbe12d820ff96570ba8db8abc36ac2fb852c87f2ef99271d7183fa

    SHA512

    fca9ffbcf94507cda23b5a68c4a598a25f0a0e22a7d429a125acbf95bdd03fd63ac80cf8738ae22d1730a73edb3325edc5b85af8d3337a62a97ac0f63dbccdbe

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\blend2d.dll

    Filesize

    1.3MB

    MD5

    27288ee5541ca1f2b9b19139ed4e9d84

    SHA1

    5c6c8cacc363f6d2cc1ce4421b06e45c6e6202ed

    SHA256

    afbdb370f738500773d98aa638206e4892ebbbbab1adffd2a6a146a40bc14733

    SHA512

    3861434bc8cbc09fecc3b14b36355f667c6232354253915ed79d89fccca963aaa694600f41e5a739acab3ae1cc4ec9feceda9dc195b3b3e3247edd37c602f285

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\brotlicommon.dll

    Filesize

    132KB

    MD5

    0e868ec6a67e491d43ca20ed71c8345d

    SHA1

    b45397b8bafa891a04476f7ffa55fb5bba0e57b9

    SHA256

    441039fe954cfb6e3545aeca5d5750b7e3322eb9efc633508cca1dbefb26b24b

    SHA512

    45e6588671c65ef5eb39abd5f6db790bf1bc8414bfa9073cc9cbbd2bdcd6b9f82a4c6ba47a059521836c34c0504b86b6aa51a19a12317084459d6a6c544829b0

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\brotlidec.dll

    Filesize

    42KB

    MD5

    1616310c08ec85ab5f0437fbf82faf84

    SHA1

    c65cb7266cd21f45728097009147596ca08c0a73

    SHA256

    d9fce48811df001c7f8fe60361f1ea270fc37df7aa73a06a853fd102317cf49d

    SHA512

    ddb8a547367cb40d29a5b3ae54edeb157a707d21993b4cbf5f83617d50795fe8c5235e1afe850515f5b3ddd286c5bd704c7a2fec14f5eb6998d4719e79bf9a85

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\bz2.dll

    Filesize

    63KB

    MD5

    37b38a8e9fbc70f3ed962e5720795a04

    SHA1

    171692daf0a136154edde6e22c791d238ae8c1d0

    SHA256

    f004cd4113a8d832fc4a57f0e28a9001c2fddf67b3544590dd36d0f60d0cef8c

    SHA512

    9d34222337bf50122c613f2132346b7dca0df51990921ff0c7372463f0be69a441eab18122c02e1a94c8fcaa71b533dd477282d74dbc769fb490f4d46aba2607

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\freetype.dll

    Filesize

    554KB

    MD5

    839c270a8ba5444eebddd293c61e6333

    SHA1

    0fcfab6030a91c722aebea4bfd1bcbe2138c71f9

    SHA256

    ac40311bc17fc9eaf16f4aaf08c07d8a256e07aa4af081c9db9b552b56119e6e

    SHA512

    d34c0f4fcd77c70fa131af3ca19ed82a1d991f599ef8bf69295be25618a0c94af859a67cd80d4893ce105559a432202281ea2ee67af352878c69f8438a1e48cd

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\lgpllibs.dll

    Filesize

    41KB

    MD5

    9616551bf5d32b5f09a05c42bfd944bf

    SHA1

    4d9310aea5fb156cb58633baff315164d68661be

    SHA256

    dc204fb1e134ae1600aa60e4fbd8a23fdb9d7ec906f5196ac7f739b8429b2722

    SHA512

    30b18d5ca4e3e9906f3ce519ad07bcb093ff814a7ab437e8626a968e83a93af26f131cd96abe1fedd8db229e4053d688629985c9b490925f94a0bbf9a6889fe7

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\libcm30.dll

    Filesize

    3.1MB

    MD5

    d91500b834eb59e906b64e412413176a

    SHA1

    d92f00dec386af08e6db9ce720b8ec322340fb37

    SHA256

    bb297db241e7adc4b4d894bbcd3cd8b62f619b3e1159733bca8487fd0ee0ce12

    SHA512

    6b9ebb3e47d5ee3a3156ffdda1f817375b22027f624ea89d9da971a7331eca65d544eeb6bfb80b5c6f6dda849e9c32400ef5dabc655f11b24343147b17e6f679

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\libpng16.dll

    Filesize

    162KB

    MD5

    8bb4c17afdeadb4c81da2f407dcb9809

    SHA1

    ce2bb6eddedf31e9dee7e43d4535250da442e852

    SHA256

    1ceae383d27ef1b45d19f7bff2ab8fe02d553c861342ac8c2d6a32f9a6c1b825

    SHA512

    b944a4b1e0e9a3b5418169429810c8933910bcdfe13b87d01027d0a4786ca7ddd44b4540da07a09b9a56a196f7681d31a878b72766991fa3dddc5221bfee82bd

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\mozglue.dll

    Filesize

    603KB

    MD5

    3db516a28e6f57f03f211a97f37f7d40

    SHA1

    2e11e182425bf400d060e372a411f0d122012625

    SHA256

    2cca9bce657a80e3714fdcd2bb4d318b932bb4e967e2efd49c553954665e2bad

    SHA512

    760e8dca2b8160708d5c55781a6c1a9e4835976e240aeac6d842ccf8544fc00cd0be7908dd14a60597051622d61eee3696c10332198b655c697be74a71686e01

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\msvcp140.dll

    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\msvcp140.dll

    Filesize

    428KB

    MD5

    fdd04dbbcf321eee5f4dd67266f476b0

    SHA1

    65ffdfe2664a29a41fcf5039229ccecad5b825b9

    SHA256

    21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794

    SHA512

    04cfc3097fbce6ee1b7bac7bd63c3cffe7dca16f0ec9cd8fe657d8b7ebd06dcba272ff472f98c6385c3cfb9b1ac3f47be8ca6d3ea80ab4aeed44a0e2ce3185dd

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\nss3.dll

    Filesize

    2.2MB

    MD5

    c21fbee0e891e185c3f861ef4cee648c

    SHA1

    1265d1ee99745428d15ab4ee203b33a2d19b509e

    SHA256

    f0dc4d5d21450922d7fa87b5fb6972d8b33d406e8efc56360d7870dc50b48c2b

    SHA512

    92ae80205fbebd4ced39d126e0f283460ad82b0e7bdd38b2300c3f90066a29ba3cebefec048c6502af9bdca86313487beedc4069c0400bb5db99e17b6c163e93

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\sqlite3.dll

    Filesize

    771KB

    MD5

    b786b64448ef03245735b099d95f9788

    SHA1

    d222e2ad8763056ffad755be405b62b9c692079c

    SHA256

    c8101feaec9e0abaae417c915e3f545b7e394c9287e3c8548e1c3684e461def8

    SHA512

    2b40aeff70feb6857b586b8f77d27fc7591f6b4e87a6281c09625aad0cc97fd965c35b41b4a0060ff5ed622f30830ba4a4e08c074776b198e78efe4b38222537

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\vcruntime140.dll

    Filesize

    77KB

    MD5

    ba65db6bfef78a96aee7e29f1449bf8a

    SHA1

    06c7beb9fd1f33051b0e77087350903c652f4b77

    SHA256

    141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493

    SHA512

    ca63eeac10ef55d7e2e55479b25cf394e58aef1422951f361f762ab667f72a3454f55afc04e967e8cdd20cf3eebe97083e0438ea941916a09e7d091818ea830e

  • \Users\Admin\AppData\Roaming\Keep Notes Manager\zlib1.dll

    Filesize

    76KB

    MD5

    0ac2236d42d8ced5dbd181bf19637783

    SHA1

    59e317e893831615b7d338f3c328de42c3a04f2d

    SHA256

    59281018c70bfec371d593d4bd005f8c52c8a3440d96fdf28ad4881bf3c4d78f

    SHA512

    3c71c2f83110e51c44a6c79efd83490bbc93f022a937d6759cfed103fc250b46a7d895df5d880247381a74642ab8eb6497463202b455f1935d28b24ae0389183

  • memory/2668-143-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-147-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-160-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-163-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-165-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-167-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-166-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-164-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-159-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-168-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-169-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-170-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-172-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-171-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-173-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-174-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-175-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-177-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-161-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-158-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-179-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-181-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-183-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-157-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-156-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-185-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-154-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-187-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-152-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-151-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-150-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-149-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-148-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-117-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-162-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-146-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-145-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-144-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-116-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-142-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-141-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-140-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-139-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-138-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-131-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-136-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-137-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-135-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-134-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-133-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-132-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-130-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-129-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-128-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-127-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-126-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-125-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-124-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-123-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-122-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-121-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-120-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-118-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/2668-119-0x00000000779A0000-0x0000000077B2E000-memory.dmp

    Filesize

    1.6MB

  • memory/5080-286-0x0000000001100000-0x0000000001120000-memory.dmp

    Filesize

    128KB