0abe30ac5946bbd5ceab283ddbcc84f553497b9c1019b28f4d1428461343c4d1

Analysis

max time kernel
8s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/10/2024, 15:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Onboard_Memory_Manager.exe
Size

10.9MB
MD5

122ca8a83c5bde6865845d4d4a546108
SHA1

28a30a2fbce253e8b061c65cb86da759d382b15a
SHA256

0abe30ac5946bbd5ceab283ddbcc84f553497b9c1019b28f4d1428461343c4d1
SHA512

87f9a8bd2c6ccdb78252db2e5b50c2e8ca87ee69f9a0d24f439d7613fbce22558c60214fc1c4ffda66e60cd2e74a6e613aac21834fe7ae05eb21afd7fe96b6e8
SSDEEP

98304:ATchecqpy/fEhE3v40QlkLd33348VA8IWwWz2sMLk6hD+bLaykjyIR2leRe:zhqhEJQl8d33348q8C6bLWOIR

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2788	Onboard_Memory_Manager.exe
2788	Onboard_Memory_Manager.exe
2788	Onboard_Memory_Manager.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2788	Onboard_Memory_Manager.exe
3280	Onboard_Memory_Manager.exe
3280	Onboard_Memory_Manager.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	Onboard_Memory_Manager.exe
Token: SeDebugPrivilege	3280	Onboard_Memory_Manager.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3280	2788	Onboard_Memory_Manager.exe	78
PID 2788 wrote to memory of 3280	2788	Onboard_Memory_Manager.exe	78

C:\Users\Admin\AppData\Local\Temp\Onboard_Memory_Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Onboard_Memory_Manager.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\Onboard_Memory_Manager.exe
  "C:\Users\Admin\AppData\Local\Temp\Onboard_Memory_Manager.exe" clean
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Onboard_Memory_Manager.exe.log

Filesize
2KB

MD5
dcb01936aa35ef7a1207283cfe097a04

SHA1
82cc0f3f00d316b6875d836c54120d1b6fa2ee36

SHA256
33153ee9c89d529ee2f02cbb6679e5706ac2a24eb58491b96fbcafaa9bfce7b2

SHA512
2e6045af2f575decf89e2812b035672630c912c260bfdb2036674a2c5517e85f893d6a3a32ceb1d644c3faf60a74a21021ee93d00a19fc0fd4f8616b9ea0c6fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\API-MS-Win-core-xstate-l2-1-0.dll

Filesize
10KB

MD5
b74d06f62cd28683b35052715273f70f

SHA1
28f0ff95c64faa31eafdc4e5e95cd7dbeb54ca22

SHA256
144eb756de343fcb063034e9708cded52fe7f83ac3c94244a8de9baf95fe954a

SHA512
fd20a4342d365396c950b7a1c1b9672b4151fc1097af3abff6af9e0723f8bfb0628ac8cf3cdbae466fcb78ad5520ce5ef7a76d76a86f889dfa98b9a4d2fc032d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-console-l1-1-0.dll

Filesize
11KB

MD5
b951011ba021c374455e8d1e18af84d2

SHA1
2d2e5e097ba5d92e6977cbb23afcc60b2e1d1c8c

SHA256
1c057286bdf0cb90f7dd1fecf5e8afbcff1e27f2a94612967c0634ae639ca43d

SHA512
bc7007ea97647b53a62561c7eafdc292478e2d1dd9cad9f84a3641eba5a57184274fd992f08a18c7f9afa82d5c37a15b6058f147e88623d5d0f5b962931b3850

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-console-l1-2-0.dll

Filesize
11KB

MD5
c26d7d913fd245afc0f0d658595447dc

SHA1
b5e00a0516b6c8c6f6a51ea40fae1beba3dd49ba

SHA256
73e4264dd66696163fbbf868729841f2e9b86f5a59912e64fb9718a8c889a7aa

SHA512
f7e22751671ef8f5d9768cb96733377cd5f38cdf241503234f69c4c6ac9348416c1a7622d7008fc1323a8673359db9e0bef29a4fec7853c5b5fe0b94e294471a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-datetime-l1-1-0.dll

Filesize
10KB

MD5
7435c7831c7b3b47e55701e5c6cca67a

SHA1
8e0fcc170f5d66beea796b38cd544a045375204b

SHA256
7ea1c2902a47fcd4a30180a4fe5ba5800fcad76b63da5ca4494e24954cea9bd3

SHA512
453fde0df6bf8867dac38e1dd155300a4fb3ab88a20de3420f14ce2c05d890459b767671b23d21422c49ff1aebb9ea84b47bee0e2b2305a7af1314393de28267

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-debug-l1-1-0.dll

Filesize
10KB

MD5
d05f970cf2bdb0da0a1bf33cbc36b53d

SHA1
505b7e21e237d7f8c454bdfb37b19932ae6980d3

SHA256
273516d86d92975ba14f0f85bdce5b81f75f8ba76e08e33575c67f34d7236775

SHA512
62b843ea200fee7868482de417048458c304a218ccacf44b70e0026bafc5e37aec4e7ad2c93513cfdbaa06e5ced7a826fa4701d27d6fb9eb81f183335fa182d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
10KB

MD5
801750157960c928af876c3ec8dd4651

SHA1
1cb405eb7339ef121df51f5eba44e0b0177a76d3

SHA256
be330de7aa8f2f33bcdabf0cec2551399b4ea0f22335a0277ea9c3a7aa405bdd

SHA512
70d84b12ec65f497720dd3ee2c634a67d2f0011c9ea825bdbf20343f3572a99432a843cb178f705d923649694cd38aea9ed97b7162138e56374cd369d158d2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-file-l1-1-0.dll

Filesize
14KB

MD5
7f3c75a78482e1ea21cdd81055b3135f

SHA1
e0fa94d72626531aa971c3f1385f03ded6bde6a0

SHA256
50347ffd660720cb1f41691be2793d00b169c864f7260dba1966a8ce5c9da943

SHA512
925ee75ea5261de55d50e0c72de891833e20975b06cf9a1712385c077fef4548639d629354969cc8d18bc7664b6b3e03ffd11d08965e2fc94b3a11d3de6cf839

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
cd3cec3d65ae62fdf044f720245f29c0

SHA1
c4643779a0f0f377323503f2db8d2e4d74c738ca

SHA256
676a6da661e0c02e72bea510f5a48cae71fdc4da0b1b089c24bff87651ec0141

SHA512
aca1029497c5a9d26ee09810639278eb17b8fd11b15c9017c8b578fced29cef56f172750c4cc2b0d1ebf8683d29e15de52a6951fb23d78712e31ddcb41776b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
b181124928d8eb7b6caa0c2c759155cb

SHA1
1aadbbd43eff2df7bab51c6f3bda2eb2623b281a

SHA256
24ea638dfa9f40e2f395e26e36d308db2ab25ed1baa5c796ac2c560ad4c89d77

SHA512
2a43bf4d50d47924374cde689be24799c4e1c132c0bc981f5109952d3322e91dd5a9352b53bb55ca79a6ea92e2c387e87c064b9d8c8f519b77fff973d752dc8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-handle-l1-1-0.dll

Filesize
10KB

MD5
d65ef6902015757c4b5e2b550c233e1d

SHA1
8b3a44beceb81727071337a9c9e7d0f3b1370455

SHA256
9f2c87a8f541fd2e563778208c51f1e1852d4874571b6c5218066c0d58f9539c

SHA512
01dc60cf2d8f902848a4234cb97b12329d813f836786407ee090083a9fa6750df7f6b4db6d3496a873fc352bba4edf109ea6d5811d124075d8f3d21008c96773

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
8af9779906d36b71166a1e286c880d0d

SHA1
deb18c79ab7def1f7ce1b22f90d21b3f6c5d8ef3

SHA256
2e9a683aa69db2f8186ce9ac3e6a610fc727390155668b2680a728a6e6c67247

SHA512
c9927edc959272747aad42f9d243119fba2d126ac7e0463b59847e3738fe62fe58c01f666791d66177949e61b6bf36da67d558475382aa71a236794137186e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
11KB

MD5
2f68cbb35c4c8e66c7d1a8b6c2079700

SHA1
2acb3bdfb7209323d586866e276e152d540d5ae3

SHA256
96509b560bc604a30af26e08d6181d24dde1d51bf3654a12cd663a4ba1a11eac

SHA512
d5886e85abb2b2b4dd0d632e56d7f056f58374b774769bc83dc84f734827fc87b91d85f609f6faae3e3c10703716b31d775ca7f5819a1f719a355a154a8cc1ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
11KB

MD5
57a0a074d52e17ce0fec69b4106bceb4

SHA1
f6fbe3fe91884d3aa19ce93156423da55bdd6ced

SHA256
f378ed4e0a68ca5fefff824912a5ec14992a6a8859e088a50a6df6d632611834

SHA512
8878c3bc77e004924e4595e03d0e717c75e44475e3bef923facd8435fbb26d2f7b3e16acb1e0516e0d0a5df502375ef86aa360d7c9cd79a52256b946896a7df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
21519f4d5f1fea53532a0b152910ef8b

SHA1
7833ac2c20263c8be42f67151f9234eb8e4a5515

SHA256
5fbd69186f414d1d99ac61c9c15a57390ff21fe995e5c01f1c4e14510b6fb9b1

SHA512
97211fad4aae2f6a6b783107938f0635c302445e74fc34a26aa386864509919c3f084e80579d2502105d9256aab9f57ea16137c43344b1c62f64e5bc1125a417

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-memory-l1-1-0.dll

Filesize
11KB

MD5
ed6d551457d8a41b48bf017b79765e27

SHA1
fa1609389caea2192f37017a23ec66e0c7f21d65

SHA256
7733252eb66a1f3ce0efc5c375fadd6fa20a596324658c72d4e707f67909a433

SHA512
a0fb6d1420c9a74266c368f246af06c173379c78f0ac6eb676aa95f5c41e9b12f52fc32ec79c89d1cf4ea67c0a8d092d0ca3caba651188598a52b1a2ff2f4c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
10KB

MD5
d8873df4158c5d449f13fd32442f10f5

SHA1
52c9bf4137e466124eab9aa639671795d05125f1

SHA256
04532aed545a391a9e95d6103a816ec5d26df14af51f51dd0c649ddd57862e5c

SHA512
e52876ca557755f50bdd3f9adf124a6a562798a725480238f747348c9f81539903f8a19eeb00a61e50f5fde6e7acc8e613b4ba94cc0d8facc2a91f98078997d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
11KB

MD5
0a34f6f91287218a1d451999957701b3

SHA1
05727b747b29845e025d2efde0e43ee36927439e

SHA256
ed755e302cc2a9f5d3cc38140a90697c6bb24965acc6cdaddb63e95c3d2cb9bd

SHA512
24d69f006cdfb91182e3cf9d917dad90353c5824cb19a00a9c4dc9feff0a279a32750a83774a5fe4f5e863386e23efb96a0b54a82c551f28822c6df410eebed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
45578c4fafc6d9d5ab6e78a07827c19e

SHA1
2fdf383c24a697a0cc29231dab4d0a77207a29f1

SHA256
6d298ae58e7651d23b75a4f6cc070794e716574fe497105fb4ef727ce9782779

SHA512
63ce2272ecc03e7e8c60395360fc685b4b144fb1cadc709f15e070e4e7b769ab282e7a652254386e83827d7982936f38a152014848e183fdb0ea38dff92e83bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
b5c8334a10b191031769d5de01df9459

SHA1
83a8fcc777c7e8c42fa4c59ee627baf6cbed1969

SHA256
6c27ac0542281649ec8638602fbc24f246424ba550564fc7b290b683f79e712d

SHA512
59e53c515dfa2cd96182ca6539ed0ea2ebb01f5991beb08166d1fc53576aeaafebbb2c5ee0ccbdab60ae45fc6a048fff0b5e1b8c9c26907791d31fb7e75b1f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-profile-l1-1-0.dll

Filesize
10KB

MD5
1672a33674cbaf42b3eec20d52930bd9

SHA1
f6e3da76e7de8a0d5f2e254b080ba973c92ba817

SHA256
a99b485112b305623ec3c8ea0d4c9acfac0c5c66821d4a98cde7b43edb8b78fc

SHA512
7b405243d474706c192e3e3b67ff61412adf41ea3bbbdcd5281aab2e7bed01c0c83a09fe60c0a0274d176a3aeb54dc0406dd044e002b8a447503c6dceb34d237

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
10KB

MD5
83cad14da9e92a8baf84a9afe2c9a5b0

SHA1
14c89f2ade657eb9249b95f9290fb4284908c9c6

SHA256
a45a7143971e7f8bbe4d5667927e3ba0fe5d0c025ef5d776ff8a5826341a99cf

SHA512
a5e93d77555e65bff5d47b2d6e9f7668cc6353a815cb1b11eaa6910594d53a9a2a538b8fe6b89cc2589f0dee321215039c012637809fc513b39fb902c02fdb4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-string-l1-1-0.dll

Filesize
10KB

MD5
990cba52bd41c096c79778188dd63a15

SHA1
4a902cf7e4500c736ab4830e762cc1e18bb224ec

SHA256
0c1cbbb4630d38632ed6a5bae9ba7e06fe19433f2a5bd548f3d73f315359d79e

SHA512
1ed847989d02ef2c57edbd4726d818ea4bd811a255873765dd6090b9f8b204dff3610e887979ff8016c9b40bdcd2eab39ed064bb0f5f4447a94d56ab24e5183e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-synch-l1-1-0.dll

Filesize
12KB

MD5
69e1eddc7cd991f9f5db2fc6fdb6f46e

SHA1
6e8a961767f5ac308d569fd57e84b56b145c6c53

SHA256
cc39ce8fe4a38a80c7b316a7191bd319efd99f9f7cb5b97fe8c3d65d2e788070

SHA512
61935e8eab14babb17dc4362e49f06119efde5de0d3b8d0e330b8b8989ffaeacefd23eada19d4747605f9e9f510ed4f11618b047f6c915554162f19e5a138f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
eb6f7af7eed6aa9ab03495b62fd3563f

SHA1
5a60eebe67ed90f3171970f8339e1404ca1bb311

SHA256
148adef6a34269e403bb509f9d5260abe52f413a6c268e8bd9869841d5f2bd02

SHA512
a9961212b40efc12fd1ab3cc6551c97c987e73b6e409c9ab8a5e1b24542f9e5884811f06883bd31d2585219c4f60c30de2d188788513c01b6cbfe22d539d7875

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
11KB

MD5
d4359815e2a7f10b4dd3ec3945eed45a

SHA1
4c83bd868c963c3afa29d92f75d185ad612c9b11

SHA256
328dff5738e59b78e2951920efcc69e97548c8081f4714540b4e723443b8feb4

SHA512
09ac1040e0a9edd8562c4b76430c82cc25ca94634a9c632803d8bc8eec6ac34d9ad5fb6509416bcd970accb6dce27730bcfeb1ce29d0920c84cc2daf5102d627

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
86421619dad87870e5f3cc0beb1f7963

SHA1
2f0fe3eb94fa90577846d49c03c4fd08ef9d3fb2

SHA256
64eccd818f6ffc13f57a2ec5ca358b401ffbb1ca13b0c523d479ef5ee9eb44ab

SHA512
dbce9904dd5a403a5a69e528ee1179cc5faab1361715a29b1a0de0cd33ad3ae9c9d5620dafb161fda86cb27909d001be8955940fd051077ffe6f3ff82357ad31

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-core-util-l1-1-0.dll

Filesize
10KB

MD5
e0727785f827d39eb167749227a316ed

SHA1
c063a309aeff016f0a7d728c44fe169ce6da12c5

SHA256
e4e4e55abf599d1a9ef7b95da0d7fd37f23a6cf1d368a77f88390eb2e0c1340d

SHA512
83c2bc0f3049b619bf39a8cd6b5fa1ee1346ada2075e7495f264360a62f6fe7ddaafb382b60dfc18857c981c584c750a0b07c1d5d81410a80c296fa1b276ad0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-conio-l1-1-0.dll

Filesize
11KB

MD5
a76584c4923b1be911d9ece4ea439116

SHA1
e025b0afc3b9a8046f83e5df718bac4ad05c9c2c

SHA256
3181c520d7ab831c8ff330afe15ad717a5a1ed85b5d91b50b838be1e5c96d052

SHA512
9e701066b81979318f41ac54ef4e1faf7a5e4cfa7482e61a60717fde10bba0851bf86f446f53a8bb26a1df95405cba0969648435fff3368bf9c2fec9ffc333be

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
88f89d0f2bd5748ed1af75889e715e6a

SHA1
8ada489b9ff33530a3fb7161cc07b5b11dfb8909

SHA256
02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

SHA512
1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
0979785e3ef8137cdd47c797adcb96e3

SHA1
4051c6eb37a4c0dba47b58301e63df76bff347dd

SHA256
d5164aecde4523ffa2dcfd0315b49428ac220013132ad48422a8ea4ca2361257

SHA512
e369bc53babd327f5d1b9833c0b8d6c7e121072ad81d4ba1fb3e2679f161fb6a9fa2fca0df0bac532fd439beb0d754583582d1dbfeccf2d38cc4f3bdca39b52d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
a1b6cebd3d7a8b25b9a9cbc18d03a00c

SHA1
5516de099c49e0e6d1224286c3dc9b4d7985e913

SHA256
162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

SHA512
a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
a6a9dfb31be2510f6dbfedd476c6d15a

SHA1
cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

SHA256
150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

SHA512
b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
50b721a0c945abe3edca6bcee2a70c6c

SHA1
f35b3157818d4a5af3486b5e2e70bb510ac05eff

SHA256
db495c7c4ad2072d09b2d4506b3a50f04487ad8b27d656685ea3fa5d9653a21d

SHA512
ef2f6d28d01a5bad7c494851077d52f22a11514548c287e513f4820c23f90020a0032e2da16cc170ae80897ae45fc82bffc9d18afb2ae1a7b1da6eef56240840

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
461d5af3277efb5f000b9df826581b80

SHA1
935b00c88c2065f98746e2b4353d4369216f1812

SHA256
f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

SHA512
229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
18KB

MD5
cce453c53f6dac9496bfa5415cc92731

SHA1
18fee669be0aa8a1839a75a167980f3f246c93a4

SHA256
50752719a62627e7a8d2c26970fe59af839692d060c009fd0652325362752659

SHA512
2cfe07c602c2e6205a2a2aa0de4ca8e105c9973d14b9d131a6372ba54697d17af7c84c898329425a3d19fd6c1434bcaf162ca0dbc5f0d20cb5973c63aee6b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-private-l1-1-0.dll

Filesize
64KB

MD5
1f72bfe2fb7bb2a403efda6ee963d259

SHA1
bcfb984771542970488bd6132dfa2746267b7fbc

SHA256
601ccd84d252fc6e024b1319902e48cf98bb922bf7799384a85640d5ce6f4a16

SHA512
e47c4c7a939d8e1022b6ce41ca15b1e3e4028f3bb302d1836bbdb3ec8d0c0141dd79ff147e6dc7fe56e09ab65dd15385362ea190d8792173674660a33acd5d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-process-l1-1-0.dll

Filesize
11KB

MD5
108433c271995786a8289afd611ea28c

SHA1
ba58c577311e39ff7e92a6be0dd6b80abfee6edc

SHA256
4c058e5b8f83ce395a7004d8c4043735526de01c5764242d4ce4f683dcf1425c

SHA512
800bd7a8702905fd9be83f17087440228f1428237d202160a5618aa6cfe1d1aad3c2608f324db38d235348bd2c8682f55d8ff52d13f9c37fa7c32d64a967db77

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
4f06da894ea013a5e18b8b84a9836d5a

SHA1
40cf36e07b738aa8bba58bc5587643326ff412a9

SHA256
876bd768c8605056579dd8962e2fd7cc96306fab5759d904e8a24e46c25bd732

SHA512
1d7c0682d343416e6942547e6a449be4654158d6a70d78ad3c7e8c2b39c296c9406013a3cfe84d1ae8608f19bee1d4f346d26576d7ed56456eea39d5d7200f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
5765103e1f5412c43295bd752ccaea03

SHA1
6913bf1624599e55680a0292e22c89cab559db81

SHA256
8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

SHA512
5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f364190706414020c02cf4d531e0229d

SHA1
5899230b0d7ad96121c3be0df99235ddd8a47dc6

SHA256
a797c0d43a52e7c8205397225ac931638d73b567683f38dd803195da9d34eac2

SHA512
a9c8abbd846ab55942f440e905d1f3864b82257b8daa44c784b1997a060de0c0439ecc25a2193032d4d85191535e9253e435deed23bdf3d3cb48c4209005a02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
d0b6a2caec62f5477e4e36b991563041

SHA1
8396e1e02dace6ae4dde33b3e432a3581bc38f5d

SHA256
fd44d833ea40d50981b3151535618eb57b5513ed824a9963251d07abff2baedf

SHA512
69bd6df96de99e6ab9c12d8a1024d20a034a7db3e2b62e8be7fdbc838c4e9001d2497b04209e07a5365d00366c794c31ee89b133304e475dde5f92fdb7fcb0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
3dfb82541979a23a9deb5fd4dcfb6b22

SHA1
5da1d02b764917b38fdc34f4b41fb9a599105dd9

SHA256
0cd6d0ff0ff5ecf973f545e98b68ac6038db5494a8990c3b77b8a95b664b6feb

SHA512
f9a20b3d44d39d941fa131c3a1db37614a2f9b2af7260981a0f72c69f82a5326901f70a56b5f7ad65862630fce59b02f650a132ee7ecfe2e4fc80f694483ca82

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\concrt140.dll

Filesize
244KB

MD5
92f00ad0d5283a6a763073e2f1e4eb58

SHA1
70bcb3c04ddf9a07f4fa65e94fc6997e58606699

SHA256
17079a00da2f4653b85c9b659088dd485bf84c0b3e5e7e80c7612caf1ef2befc

SHA512
2a7ba56ff5b8bc7b8e7c2729c9e59e806f91188a594f306d8524b01c3752066709030f206aa1556507a90944a58d53e497f8774f90d8e8b5fbd31eec6430ffb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\logi_nethidppio.dll

Filesize
2.4MB

MD5
d94b240f8f0639ea22ad70c531f0f481

SHA1
e79905ee8e3c2a8d4fde43a65d2b1ae00aceaf30

SHA256
6b00b8f175e6026d9ee022500394ff04997c63848d9c1d1e54fa8c0277aa971b

SHA512
5c4e879a15dc868b0ddfd7674ebb6cd496ac82cae971343ddbec68a4f8bc4174ffb5d320eae8c2488d2070c38ad91df7c0876567490531c329100b9774cf4f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\msvcp140.dll

Filesize
443KB

MD5
697220335e5c4b4126af45f6f8207896

SHA1
8106f2dd4665aec0d1c652e29378ef46ea4e5801

SHA256
d7446822c53cf6b9e31d5610d838ebf26ed08bf7497a3e022c47ff193ccde0be

SHA512
b820735e96600a1382d4097a7638f3286335d93032152b8c85e4ea8196439dfe687e1f8309a81f13a43705a323eda12bd69efac50a09048e57498cede4924cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\msvcp140_1.dll

Filesize
28KB

MD5
511f8cf3e1c960b5aa76fda0b845d246

SHA1
6ba029a7c545d64c044aaad93a3dd00702bdf44e

SHA256
4874449ee85bca44be95dea5fad6ac4f0f5456788c928844702cc5ed4935dd83

SHA512
5d0f04ad49ac91202254981cb69ee6eeaef2c89535b5f396d03eb8bc42b786af6db1c3763807597dbdd3e13736b70bfbdef9149ec45190e7db1e03e62f939ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\msvcp140_2.dll

Filesize
169KB

MD5
57ed07cb2b239d7cf58ef98040a9b4bd

SHA1
40be57a54102ea5af3d3173c8815bdf35761e5f5

SHA256
940ff0f7ea7149084533cf81156caa42a05bb44656164d769dcb299ecf7a350c

SHA512
5459fb26218c13bfc8284e446403964d77cf27aba51a5149fa7cd916c405811f80a93c93b1310044d586cb7c00489e3afddc97343cb40d945baaeb4b80e971f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\msvcp140_codecvt_ids.dll

Filesize
25KB

MD5
4905d449e1c36735af33a8cf4f08895d

SHA1
d34e3f579507f23c6b3378da44e666b85fff6e3b

SHA256
54cf497485e1247f04ef705157cad26f2fe9d0c353d5970a6ff8e5848504c4de

SHA512
6ff95eb8b191d970e145c6a6de98370a0b464be215a5a2dc14e98bef03dbb886444ceea0906dffefe07960cc870af377d64ac4eaf6d9fe7e7f5e0d4a92080559

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OnboardMemoryManager\vcruntime140.dll

Filesize
81KB

MD5
4c360f78de1f5baaa5f110e65fac94b4

SHA1
20a2e66fd577293b33ba1c9d01ef04582deaf3a5

SHA256
ad1b0992b890bfe88ef52d0a830873acc0aecc9bd6e4fc22397dbccf4d2b4e37

SHA512
c6bba093d2e83b178a783d1ddfd1530c3adcb623d299d56db1b94ed34c0447e88930200bf45e5fb961f8fd7ad691310b586a7d754d7a6d7d27d58b74986a4db8

Download Submit
memory/2788-83-0x00000171E0DE0000-0x00000171E0DEA000-memory.dmp

Filesize
40KB

Download
memory/2788-85-0x00000171E0E00000-0x00000171E0E0A000-memory.dmp

Filesize
40KB

Download
memory/2788-108-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-106-0x00007FFE8B1B3000-0x00007FFE8B1B5000-memory.dmp

Filesize
8KB

Download
memory/2788-104-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-103-0x00000171E1EC0000-0x00000171E1ECE000-memory.dmp

Filesize
56KB

Download
memory/2788-102-0x00000171E1EF0000-0x00000171E1F28000-memory.dmp

Filesize
224KB

Download
memory/2788-101-0x00000171E1F50000-0x00000171E1F58000-memory.dmp

Filesize
32KB

Download
memory/2788-100-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-99-0x00000171E2200000-0x00000171E2728000-memory.dmp

Filesize
5.2MB

Download
memory/2788-75-0x00000171C8590000-0x00000171C859A000-memory.dmp

Filesize
40KB

Download
memory/2788-76-0x00000171E0D70000-0x00000171E0D7A000-memory.dmp

Filesize
40KB

Download
memory/2788-77-0x00000171E0D80000-0x00000171E0D8A000-memory.dmp

Filesize
40KB

Download
memory/2788-80-0x00000171E0DB0000-0x00000171E0DBA000-memory.dmp

Filesize
40KB

Download
memory/2788-81-0x00000171E0DD0000-0x00000171E0DDA000-memory.dmp

Filesize
40KB

Download
memory/2788-97-0x00000171E1790000-0x00000171E17C2000-memory.dmp

Filesize
200KB

Download
memory/2788-98-0x00000171E17C0000-0x00000171E17D0000-memory.dmp

Filesize
64KB

Download
memory/2788-82-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-161-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-84-0x00000171E0DF0000-0x00000171E0DFA000-memory.dmp

Filesize
40KB

Download
memory/2788-1-0x00000171C5CC0000-0x00000171C67B0000-memory.dmp

Filesize
10.9MB

Download
memory/2788-87-0x00000171E0E20000-0x00000171E0E2A000-memory.dmp

Filesize
40KB

Download
memory/2788-96-0x00000171E13A0000-0x00000171E14B2000-memory.dmp

Filesize
1.1MB

Download
memory/2788-88-0x00000171E0E30000-0x00000171E0E3A000-memory.dmp

Filesize
40KB

Download
memory/2788-89-0x00000171E0E40000-0x00000171E0E4A000-memory.dmp

Filesize
40KB

Download
memory/2788-90-0x00000171E1340000-0x00000171E134A000-memory.dmp

Filesize
40KB

Download
memory/2788-92-0x00000171E1360000-0x00000171E136A000-memory.dmp

Filesize
40KB

Download
memory/2788-94-0x00000171E1380000-0x00000171E138A000-memory.dmp

Filesize
40KB

Download
memory/2788-95-0x00000171E1390000-0x00000171E139A000-memory.dmp

Filesize
40KB

Download
memory/2788-93-0x00000171E1370000-0x00000171E137A000-memory.dmp

Filesize
40KB

Download
memory/2788-91-0x00000171E1350000-0x00000171E135A000-memory.dmp

Filesize
40KB

Download
memory/2788-86-0x00000171E0E10000-0x00000171E0E1A000-memory.dmp

Filesize
40KB

Download
memory/2788-79-0x00000171E0DA0000-0x00000171E0DAA000-memory.dmp

Filesize
40KB

Download
memory/2788-78-0x00000171E0D90000-0x00000171E0D98000-memory.dmp

Filesize
32KB

Download
memory/2788-74-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-73-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/2788-0-0x00007FFE8B1B3000-0x00007FFE8B1B5000-memory.dmp

Filesize
8KB

Download
memory/2788-56-0x00000171E10D0000-0x00000171E133D000-memory.dmp

Filesize
2.4MB

Download
memory/2788-51-0x00000171E0E60000-0x00000171E10CD000-memory.dmp

Filesize
2.4MB

Download
memory/3280-109-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/3280-160-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download