fe9b416627f297d8c73d4daf97751d5184af6b6ccb5dd04a74c4275e87b473dd

Analysis

max time kernel
25s
max time network
28s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2024, 20:08

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

reboot_launcher-9.2.5+9.2.5-windows-setup.exe
Size

69.5MB
MD5

435b5c2ae932fd1c247a889163330a01
SHA1

488433fdaaecb12ce577f6c65a1ccfb97db8a7aa
SHA256

fe9b416627f297d8c73d4daf97751d5184af6b6ccb5dd04a74c4275e87b473dd
SHA512

b2e044a26f3b5779794b7bfcc4f97dc4cb4fdde647dc680c52c28b1c54e127c3f221560541ef4ad2e7f1011f44c267e20e5ac30c3a6962c79cc2aed10cea4d19
SSDEEP

1572864:6IajZzHxeCsseRh48yh4Vuqhb4UEjKFtlGn32pBfVlSvNhb4qEt2WS9:nabnWRh4JMnhb3E203eBfVlSVhkt2WS9

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3952	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
3664	_setup64.tmp
3440	VC_redist.x64.exe
3128	VC_redist.x64.exe
2476	VC_redist.x64.exe

Loads dropped DLL 4 IoCs

pid	Process
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
3128	VC_redist.x64.exe
1444	VC_redist.x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5af95fd8-a22e-458f-acee-c61bd787178e} = "\"C:\\ProgramData\\Package Cache\\{5af95fd8-a22e-458f-acee-c61bd787178e}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2240	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reboot Launcher\is-64B0R.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-83L4D.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\fonts\is-QE73I.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A2VOO.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3RTTF.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GEBJH.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-V3LJM.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-T7MRD.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PPNMP.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QUFB1.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\is-M0PNN.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3LPFI.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-C08JT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-H22S2.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-K526M.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QACFU.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LVPM0.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M9RKI.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QP1IT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-58OHD.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ELM0C.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D4BPR.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8CCQJ.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2UCRM.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ALMHQ.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CAS4R.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G5O6L.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HCGOC.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4IUDU.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SK0M1.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-55167.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RM764.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-THGAU.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KMKJS.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2GLU6.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J2HCV.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-88PBT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UQ39T.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1SB9C.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FEMCJ.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-87UIT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TCPBU.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5DVK0.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P07TB.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7DJU7.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JO9FD.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-9SUCG.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UT2NT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SFDCD.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File opened for modification	C:\Program Files\Reboot Launcher\system_theme_plugin.dll	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-SAANK.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UQE1F.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-836AB.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BRUCL.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BKR91.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PIRI5.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-O758D.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FI44O.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-4IQUT.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IDD5F.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESN2E.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KK017.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AQ1NI.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
File created	C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-DKH0C.tmp	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57f4aa.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8B4529F6A0FB7A59.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f482.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF8F3F5C540DF2F0E.TMP	msiexec.exe
File created	C:\Windows\Installer\e57f495.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7822F263CE69815C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF85B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCBB37E8781CB7BD6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57f495.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B3A9D66FEB6C2B2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2698D70A54FEDB6B.TMP	msiexec.exe
File created	C:\Windows\Installer\e57f494.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDC8EF6C39A528280.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE77.tmp	msiexec.exe
File created	C:\Windows\Installer\e57f482.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6B4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6015CBD1126DA08B.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reboot_launcher-9.2.5+9.2.5-windows-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000010ed058f6a88e7de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000010ed058f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090010ed058f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d10ed058f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000010ed058f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\PackageCode = "0F1976868EAF8784585CF1DB265C6A81"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33810"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\PackageCode = "A40E8013387385E43AA0F61A9357B166"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{5af95fd8-a22e-458f-acee-c61bd787178e}"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.40.33810"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}v14.40.33810\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{5af95fd8-a22e-458f-acee-c61bd787178e}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A4BB3B8BD01A15F4197B6AF4AF3CE17A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33810.0"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Version = "237536274"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33810"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
3952	powershell.exe
3952	powershell.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe
2240	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeBackupPrivilege	4740	vssvc.exe
Token: SeRestorePrivilege	4740	vssvc.exe
Token: SeAuditPrivilege	4740	vssvc.exe
Token: SeShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2476	VC_redist.x64.exe
Token: SeSecurityPrivilege	2240	msiexec.exe
Token: SeCreateTokenPrivilege	2476	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2476	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2476	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2476	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2476	VC_redist.x64.exe
Token: SeTcbPrivilege	2476	VC_redist.x64.exe
Token: SeSecurityPrivilege	2476	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2476	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2476	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2476	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2476	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2476	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2476	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2476	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2476	VC_redist.x64.exe
Token: SeBackupPrivilege	2476	VC_redist.x64.exe
Token: SeRestorePrivilege	2476	VC_redist.x64.exe
Token: SeShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeDebugPrivilege	2476	VC_redist.x64.exe
Token: SeAuditPrivilege	2476	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2476	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2476	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2476	VC_redist.x64.exe
Token: SeUndockPrivilege	2476	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2476	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2476	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2476	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2476	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2476	VC_redist.x64.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeBackupPrivilege	4936	srtasks.exe
Token: SeRestorePrivilege	4936	srtasks.exe
Token: SeSecurityPrivilege	4936	srtasks.exe
Token: SeTakeOwnershipPrivilege	4936	srtasks.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeBackupPrivilege	4936	srtasks.exe
Token: SeRestorePrivilege	4936	srtasks.exe
Token: SeSecurityPrivilege	4936	srtasks.exe
Token: SeTakeOwnershipPrivilege	4936	srtasks.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4808	MiniSearchHost.exe
3092	LogonUI.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4304	2004	reboot_launcher-9.2.5+9.2.5-windows-setup.exe	80
PID 2004 wrote to memory of 4304	2004	reboot_launcher-9.2.5+9.2.5-windows-setup.exe	80
PID 2004 wrote to memory of 4304	2004	reboot_launcher-9.2.5+9.2.5-windows-setup.exe	80
PID 4304 wrote to memory of 3664	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	81
PID 4304 wrote to memory of 3664	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	81
PID 4304 wrote to memory of 3952	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	83
PID 4304 wrote to memory of 3952	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	83
PID 4304 wrote to memory of 3440	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	86
PID 4304 wrote to memory of 3440	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	86
PID 4304 wrote to memory of 3440	4304	reboot_launcher-9.2.5+9.2.5-windows-setup.tmp	86
PID 3440 wrote to memory of 3128	3440	VC_redist.x64.exe	87
PID 3440 wrote to memory of 3128	3440	VC_redist.x64.exe	87
PID 3440 wrote to memory of 3128	3440	VC_redist.x64.exe	87
PID 3128 wrote to memory of 2476	3128	VC_redist.x64.exe	88
PID 3128 wrote to memory of 2476	3128	VC_redist.x64.exe	88
PID 3128 wrote to memory of 2476	3128	VC_redist.x64.exe	88
PID 2476 wrote to memory of 3352	2476	VC_redist.x64.exe	98
PID 2476 wrote to memory of 3352	2476	VC_redist.x64.exe	98
PID 2476 wrote to memory of 3352	2476	VC_redist.x64.exe	98
PID 3352 wrote to memory of 1444	3352	VC_redist.x64.exe	99
PID 3352 wrote to memory of 1444	3352	VC_redist.x64.exe	99
PID 3352 wrote to memory of 1444	3352	VC_redist.x64.exe	99
PID 1444 wrote to memory of 1568	1444	VC_redist.x64.exe	100
PID 1444 wrote to memory of 1568	1444	VC_redist.x64.exe	100
PID 1444 wrote to memory of 1568	1444	VC_redist.x64.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\reboot_launcher-9.2.5+9.2.5-windows-setup.exe
"C:\Users\Admin\AppData\Local\Temp\reboot_launcher-9.2.5+9.2.5-windows-setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\is-1CAI3.tmp\reboot_launcher-9.2.5+9.2.5-windows-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1CAI3.tmp\reboot_launcher-9.2.5+9.2.5-windows-setup.tmp" /SL5="$B0250,72033253,832512,C:\Users\Admin\AppData\Local\Temp\reboot_launcher-9.2.5+9.2.5-windows-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\_isetup\_setup64.tmp
    helper 105 0x3AC
    3⤵
    - Executes dropped EXE
    PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\VC_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\VC_redist.x64.exe" /quiet
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\Temp\{9DBF2828-7B21-4298-8E1A-5500D048359C}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{9DBF2828-7B21-4298-8E1A-5500D048359C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\VC_redist.x64.exe" -burn.filehandle.attached=612 -burn.filehandle.self=620 /quiet
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\Temp\{41F1C7EE-05BD-404B-AB40-20551C3291C5}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{41F1C7EE-05BD-404B-AB40-20551C3291C5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BAFA939A-F577-486D-A273-C717AC8D1282} {105CD544-B4FB-4F0B-B769-9F50BE109C1C} 3128
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=952 -burn.embedded BurnPipe.{0DC0B71B-7746-47FC-A098-C59EEC6B50D9} {D6B92769-5101-4CFC-B079-13BBC8D7D2B1} 2476
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3352
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=616 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=952 -burn.embedded BurnPipe.{0DC0B71B-7746-47FC-A098-C59EEC6B50D9} {D6B92769-5101-4CFC-B079-13BBC8D7D2B1} 2476
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C1DE672B-808E-486A-9715-8FD406CAC281} {B927B5A7-581C-428A-90C8-49F5D4718A68} 1444
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57f487.rbs

Filesize
19KB

MD5
62f61cd6a5557ed258e14be9b032be08

SHA1
3e05696dd11deb5fd45462879d66101ed02dfc1a

SHA256
6ff6d5af4248bb155d342c168e5927ea1503c52ffe698ff5df9592470189ff8f

SHA512
8645b58fae92f6bd346b41ce53b45a032a7293726dbb44bd26c60bbceb41df4be7f4d83afd670f377f5e57e3efa5ea9a45f8f8e1e2fd51194556745d0b2c8606

Download Submit
C:\Config.Msi\e57f493.rbs

Filesize
19KB

MD5
f7bc88938dc257d50aea653e2d2db8fe

SHA1
1a5968fc2715b6ff02aeedc4b4a676a36e8c2c91

SHA256
df8c85ca666dd9a77188ce6628b022dd0a74f425ac1187f62441d5e9593f8eb8

SHA512
3f25c6f697baa6611cf5da3826fcd3a39833397148d7763e1a73b8a7ce5fc05f50e5abb5e2277df54f221e629b22fd1c0ab9f6ba0478839ac3645e8c59cd37b8

Download Submit
C:\Config.Msi\e57f49a.rbs

Filesize
21KB

MD5
94a3dfc501ffec41a5009cd09392a1c2

SHA1
9f2498da2ee4c80803e4cff418767f7f4a86a23e

SHA256
9efd245d1dc61b9864b04fdd2facee4ef1ce77ce023485b476828b52dbed7d16

SHA512
b74f72c37a3c3eda1661f33cd131cfe6039aec5f7002207e41338ecb4908259897f21b6ed046d982535707db4297dbf66710a9c80366e15f81b638710aca0398

Download Submit
C:\Config.Msi\e57f4a9.rbs

Filesize
21KB

MD5
986f7e6a6538c1b6c0eec608ab1e8e1d

SHA1
afd757d9350f6726d50f89e661dde9ec18b17e65

SHA256
97c15dd18aadc79ee99c22df39543e640b5d4ca5704fa0a259f0f604b8d9d500

SHA512
14774bfe5b8097c120b5f8b0a8e385008057381b8846b10718985260a0eff0dd04a6c2848184bc3f2637189b671396c627d8fcfda933c3223b0db4de677bdf50

Download Submit
C:\Program Files\Reboot Launcher\app_links_plugin.dll

Filesize
89KB

MD5
a76d2a056ffc4187bbffd04cbce9bca8

SHA1
8f4b803276df46a346a5771813e5f792fe57cd4b

SHA256
5628a61a0e97c709226f2506960662fda8a0a79160392ff6164160d32f101da0

SHA512
1cf83ec8f58917ead85584a0a32a13b3bec72edd15e3bd4265f780b726836843dc13a6032d47b8d215bc481691fc4d2f87a18e063fbf6bbe799f160433a363ec

Download Submit
C:\Program Files\Reboot Launcher\bitsdojo_window_windows_plugin.lib

Filesize
179KB

MD5
93bc8ddce849ba02020f37f90c5be2d2

SHA1
ffe2bc09bf887650695d6b31268c4d103bc27708

SHA256
ad0a34442001839e863a7f014b94063a0b7cae2cb009f8d5a5dc1802b7a8e471

SHA512
56bb2dae328853d97228ff3e3ba8d4aab9a2c3c77916de9c1923037b8641eb088e88ccbb4e1173a978d231ae4e31a73e8959ecc1dc7e685f9cdfb0aab6784c72

Download Submit
C:\Program Files\Reboot Launcher\data\app.so

Filesize
7.3MB

MD5
d0dc46f4ad9b8c1a9a291258fb394a7a

SHA1
227579b9db63e7e1a07d7d78f3033730acfd7eee

SHA256
97b28a9a56ef9d329724d03c8505cf67d648bf945bb3898f888f5dc8359749a9

SHA512
dcf0d1ca011d6a2871db32a2d76532ece2070e15888164290877b2c0bc7debb82b9134767b04c050672bf99a73cf5dc9c067b5e0bd495b2f95a378102d333b5d

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\AssetManifest.bin

Filesize
70KB

MD5
9b4c4dd7b20bf02fa80879350dd87306

SHA1
13c55e0b92f073629ab0b5d2a1245639741776d1

SHA256
6637f47b4880e432c9e9d0172d6b1450e1b13943e3feac2aa1c1c1c505ce76f2

SHA512
6f436cad23444ccf7bf1aff6881f30a3cafecbd5961baf907070fb942920393a76b424ccf1f82a4bcfa1a5490ee4ff18ebe9e1d39441057c978c49f645ff50f4

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\AssetManifest.json

Filesize
65KB

MD5
60a6cdfbee74e781c107d82ffd664908

SHA1
cf55dbdbd4e4762555722f6d5e9d2b1cb163ec97

SHA256
a65fd7a5744109b9753e43d2622f40d46d8653b2c99bfc92f50e531eda2c8a65

SHA512
69c726906901a4f7b61e42d66cbba69e0a0a2e9bf94f40746dd7629855637b5d2fda807354e6ad524fcd5119a36506067d3cd145ad7d0bc93ce03486cab5857c

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\FontManifest.json

Filesize
505B

MD5
8caa442fc65746900f933ee2a63f5b97

SHA1
d0166283e7e1dff49a6e49fa2abcfe0b9803b6a9

SHA256
bab67ac982d2e5d466a5baafbd9e004c5ea1e6e07881327640a1028dd0395d90

SHA512
bf87fd7667bf06ba48ac159a521bc32855e3e0007b8388d2b55c59281c31c5de60e86e350a33fe927609681ad2e8c2be8caa2182b3d28f62afbe8c326208aaa8

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\NOTICES.Z

Filesize
97KB

MD5
e9a41265b4ec908a754c1cffd992d384

SHA1
a3c1439657912cae0956d7f673ec87a30de0e775

SHA256
d792549cb77bd17f42c579b143115f4fb81bbc9c7b78fd2cbd0874d7b0bc1181

SHA512
918d3eaba1e519e80241a50fad83f78f529d2ecb7f650c94998641a5fe9e73ca1929e84e5069e705d8ef46a8301f1e55b22a8168134b96ac645c9b7b45ff23fc

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\DefaultEngine.ini

Filesize
834B

MD5
cfaa9e710a0bcf707d4ed9c92f2ebf5f

SHA1
6e3492cdafcb967634bbd83cedb6c16432d64728

SHA256
84b40aba694d1f183337c19b16893565b35b0108a220cac2f884b3d4fa5e5bd1

SHA512
a8f401dc4ea5005b1b9cde8876ef7a4f321490f1129693d84daf2af878ceef74824febdb81721e127476855fa663965562ac91d56f50dc789b24a61f7d13148b

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\DefaultGame.ini

Filesize
3KB

MD5
1db7ea439b9ca7d16d26519f7f7a0557

SHA1
99a96a4152847aca2456753a090d14fe52eb099d

SHA256
d6614ce021dd15fdc0bd3724bba982463b6957baaa5b650664ce6bdeadcf836a

SHA512
e32013d71d9857f497982cbc4b4cbfd244ad56f5240eb57ec0768dfa8a8d79ec2f64a7531f837071a0e6323ea020c88c99dd90fc1342979ab2af638f988df6db

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\DefaultInput.ini

Filesize
140B

MD5
bcdb6fc7cc50367478870a5a246e40c9

SHA1
f4e2ad51e329f9cb4360bc4a21895d40be19b8cb

SHA256
fe79e7f0881f826b0ffdb7da24fa7dc7c4f1431dc56c40a51c16cdd4095acd1d

SHA512
6bd0e587799bf2b0ef5f098c290f1c3a6b5044dd414c871ac864f86d9b206575944ee29c197afd22af3dc9eab8d0230add8eddc736833cc48f24ddd3885d5132

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\DefaultRuntimeOptions.ini

Filesize
743B

MD5
feafd07dc9cb7de979833151c80a9d57

SHA1
9ad69c617a9a75a028e35fee86dd3e007d113aa6

SHA256
ff49d46eee13650648b41b38a4bb296cc93f114eb2a362aa49e2a50c6d05db5a

SHA512
7e64a89e6fe7ff9e491f5ec572125b1e8043b8736b68f8ed59c4e83597cb1e1e1bd9d1c4324169c1430726a124880c27152ff1d91c905b7469be3a206ce267bb

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\catalog_config.json

Filesize
635B

MD5
5154dd9a3b2b9ee3e9b41aa0481b150b

SHA1
9bf86622d2c2cc5061972207ff0613cb7f031625

SHA256
0a4eef6a8209257169e846ae7ae3c1684858cfbbe2e5b0e8cd8cdd1e4cc7d31c

SHA512
ed4a935b17e3932b0fd7d5ff83d8ceb02b991bc8392ac0c7667df28bf4bfe511a7b87da9dbf015af3b28f0c18e0df9d3adbe6c9df4d4426b056f894f7895b408

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\config.ini

Filesize
3KB

MD5
afbabc3bbc346127ef6628925757eabb

SHA1
9d9e90b5e67dbcf4d837d9b1d7c5b9840331f587

SHA256
50aaa4c475a0aca4736fe7bd6be3101256d6e19e9e27d94a6a3a3f91b5d3f191

SHA512
f332f2948fa39f21f19b2b68e18c609002f62bd86f7b64c7c1d142c9209e9f5996509a42b4b6e040a70ca60712e055f063f25b0ff4f9f0d6bc39a89a8492f3db

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\athena.json

Filesize
3.3MB

MD5
4db396e20f7299702c40f26bef1e83ed

SHA1
f30a957d65918f17fc54122256cb347b862fe119

SHA256
c3be183a6606b492862f02c1d2d1986a20e194187e5628d7a87fb0f496676ac1

SHA512
06ab1db050495f1abe4d91be7bb548d937ae957613a3ed5ea5fb21cc2c6d2d281d8dcfa2f3d365a2abc68a048359939fe068eb5e2ebd91ffd335c9ba6a28fded

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\campaign.json

Filesize
1.7MB

MD5
50f4fe217045f00f00006d0de0b45a6f

SHA1
51550b7d05a3a2b5313597e09812bb0d59c5959e

SHA256
3607ba803e160dbfcfa044d90e17c35bfc40cf41265cc7694c62bf1f73421ffb

SHA512
ca2a0b75f2c652883983bb73595472dfdf50fa575edde6dbfb7be5b91a1576374c44b8b918e447c3f7d2cfc911a7d6500ce548337cea3480714401d9da833aab

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\collection_book_people0.json

Filesize
5KB

MD5
7bb883975aff5efc3d21b1486a96267a

SHA1
682ffd47c2e7e23a41baaa4a74d02b08ae19835d

SHA256
9aa8ff09c85347e317bd70eb8ef5e1d58771ac6931babc6e38acf79fed6476c9

SHA512
37dd3e7c91f778a718474c88f4351b987e6f4ede14ab920480517281af8cf7c41761d7b0604040b8b65b9d84582e70a3454daa7e5a7e4b4b8dff929f5837752b

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\collection_book_schematics0.json

Filesize
14KB

MD5
9a7b68e65d64f059c37b894f5ff77ebf

SHA1
c1b371326f197c288798a7830b0ec03e4e621aab

SHA256
e31c06b4ad1effa8f47897d27ecb2c4f39a6926bdc09dd39c60d81463d2d9915

SHA512
462f12faa68117f212c0eb1b6d82adcc888a94e57161201ff6cd09449a739bb30319bdb6f0c9cf8537bc6a08948169d74beac9f612e30e82a53cce615e59c1e8

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\collections.json

Filesize
318B

MD5
56e845daf03711e8fac7055ada2f8e2b

SHA1
c21f024a34a82c11b62dbd4c446fb401c9ad82c3

SHA256
b44bed9630622dddbe1a8fd6d2976408afe3adf670f7828624295ce9248cb1e7

SHA512
ffc77317fecb823d6c0ae1d116acc2562d45fb5c3195c4f0f286924bd2b559f9651913dd6312e0ba950320af1b9b1598c779f55a09996de71f2f6848e790fdb9

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\common_core.json

Filesize
61KB

MD5
bcaf5971bd7711a3152411facd9fcc56

SHA1
f0707d37c02d241b25eb0e3a4cd0e9feeedad786

SHA256
205bf8be349b09cfe181c1a1f25a22b468ebaeda795cfca19a760e4f5273bb20

SHA512
234c55a0742419570cd102a10993eb2a255f96221b184fa4adc572ec5694c005dbcabadb09441f7311fbafffa74e5439e24562152f79e71a49e4935a1105e660

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\common_public.json

Filesize
451B

MD5
4f89d71a17f7522a6675901ccea14cb8

SHA1
f11ba4a3ddc5a6e993c3ab59c6316dcc8ed294a5

SHA256
334d7bb8264008ff275edb1e03b74a79ea17f4535f4d0fb0fbd7102a40381fde

SHA512
651f19dee139457b43dfdef9e283089aa271a6f1849c234b9e5b5b71f55f0192ecfd118cbd34501707a9e313b2a7169490607a54e111676c833ec35cb422beda

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\creative.json

Filesize
315B

MD5
b06fc534afe78727afa5b1f44547c336

SHA1
3cf0c680bd6f2a910abf4e0abe489d4cc2b23fae

SHA256
d18728f8211e3e627475e329f4092b0867219bd604994314a2e7617198594741

SHA512
34be00432cb0a0e5d8954a271c3ea8a480738291bd5b81be3ffc6fa8618890e11a61f48bbb575709098536aef178225fa39c4eb62be10ae7fa5578d6b1b69011

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\metadata.json

Filesize
7KB

MD5
fa5fa90eb42836c18d976b8e91a1d053

SHA1
b5d262ee5f1db639dd1c0444087eb86a93fbc2cf

SHA256
b1c67941a6b5897a94dabb2d679d054131fa5694b8cdd2b138bac5eb1180966f

SHA512
e4dfda11b0e4ecce87bedbc0833d2e06283cf7c58a04403e3a72ed43b40e0da520645b13f99c98c2cc644b3df5abc20563a625720daa2b0ca298354230520f19

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\outpost0.json

Filesize
355B

MD5
f8a49f4264aede58e29fa35163320bcd

SHA1
a01f6d9ca1c52f58cc15e6bd67dc018299132cc5

SHA256
712425333fc3c65ba54a86f72113e95325277488094960386c2fc086089f3222

SHA512
9da349c8af70884e4f534efd7b7db7eb94dd41a0a27f4603e9cd7ee1658207626b468387cabb635c5062030ba3d42b6c0e828cdaa274ee0cf0e88c47c023e81e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\profile0.json

Filesize
926KB

MD5
8a23d8ae90939a30cc1b5b0408540a62

SHA1
09f8a8f0c8882f7bb3bcc48cbb0d50246f5080a2

SHA256
a337be1968224f515a5f4ca0cb76a14c55861aa7d9bdc570fc2b8937edbe0af3

SHA512
d0ae1b01a696c6fe87a78db2fa704d90cd0148748b5dba5da363df1d9394865b8693eb57c5a0baf5789bc1772d4909bde06d9c687fb74edcc1f18160f0f7d00f

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\theater0.json

Filesize
18KB

MD5
9864a552f0453f2e2c8b9342e6867cd2

SHA1
3d4d4f3200ac076535f7fafbbb0b5264fbd5b8ab

SHA256
65e1a8bd315106d9c76c019e7e1927ab42513e5a0d651e7888cca53459c05cec

SHA512
ef36242fce323b9d2b77e0db6cd0ab31a5462f16f49994a19b7dad376fd71c6308c203154b41c677960eb4ef4b8343d22da05964536fce66901b393742f9dd46

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season10.json

Filesize
9KB

MD5
be7395d4dbf5e4a2f3fe8d00db248f04

SHA1
8bd2c719d82853be709a5825288e6c7530fdf890

SHA256
c47df9312dad194aeff6342dbba8451951c5145db686b5985593aa5a1914a0c5

SHA512
b027e9b27bac754707f7bb83dffcb7bf0acac03e08b3145a7f3aea1fd2fd9706d58fa459232808e9efa01785446a8e4cf7335c448dc2940686b41883dce04b05

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season2.json

Filesize
5KB

MD5
24ceedcfb4fa7c4dbba4984ab69371af

SHA1
8f5e935e0772d577207899e077e104affc43af43

SHA256
3e350e6788bcf3989b8a74bafc2ad5d33f9d8b60a8d6c6356d916ba8d37f5880

SHA512
690107c92c7b5f34b60568d5a098569de36e504cc88d8bdb05e5de0cfdf3c4f40dc93c51f67ef3f317ba31a13c3e3e74eabbb83661d723d1edfa8b473bc46f7e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season3.json

Filesize
7KB

MD5
bfb1a930c84c233add890cdeb3ad31f7

SHA1
7afc9f0398fe20388fc59956615c0fd27ff9aac4

SHA256
80fbc5f942b56b56aa81c29550d95e035d0e9ded59f4b5b5477162a3efd45a34

SHA512
714efbd20d2d939004a5a226ae66e9c5be080b1746cb6e8b1db83ce7826fcd3323aeeeb79e7b77915c53199707c64d70dd4a1b8f906faae5c70c8655d1d1dc86

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season4.json

Filesize
7KB

MD5
d095067d4023fda316c084ed9ea27ae8

SHA1
4bf4cd7aee96f92b84b0c78b49ed8681822112d1

SHA256
f4a598082ef9263f4fdbdbcdb4e2a17dbf115937d334ce9bb14bd61ef72f4c6b

SHA512
7c37ca2bf203de883d207e8057e8d7282004523be617286f7babc658343966a19a19b92f981e102137ab8ae5fe4550cb61d5e234aadda0bb2f4def19238bdb08

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season5.json

Filesize
8KB

MD5
7f12b5246b8bdccf19dfab2a15f336b8

SHA1
f1b5dd0d257a3f74a58c2b13041d9b96aa6c369a

SHA256
d02ebd9878892cfbc254f0df6830a5c69fd4344c0b92c9937fe0d277ee51af1a

SHA512
8e92c4bc4f204b1093d0ea70e272dd463fe51178739c7f2689158a4a2aae48398646d8baca47b78648ff618534e307552e398660b7d4b6dee62dc3c8045a17ef

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season6.json

Filesize
8KB

MD5
a704a1bacc0d1a80dd09b8504b2e89b5

SHA1
bc85ec613886e2184986133c8072b5cca96f3a57

SHA256
eb5f67065c0de33b12ffe5157f781122c479d42ccd736bf0bc9d39e8da36b33c

SHA512
83e1f32eab542084caf48e1b93416309565d4519322ffbc7e25c323dc00da466487289d8374dbb37ba31cdc318db5acbc7d4badb7e4830dadd9525e7a3097111

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season7.json

Filesize
8KB

MD5
87643aa871c28fa0684591eace6f28dc

SHA1
a323010623f3841413021999225bd53716d9b911

SHA256
9ccf7a0a6c6a2b6768ae26fac14c42b3905be6f048d86b392c523513aec07203

SHA512
0eef145096aac8a743c033284a34c7944c991639856711387f52d2f430b607e8c74adc546224d11913bd49043aafe7d5871255eb15e530540024978ac8da1e46

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season8.json

Filesize
8KB

MD5
43e5bacdf769471c516d68b900b9a5bb

SHA1
9b22f4c472f3d549abfd1aa34ab5418b9f79ca12

SHA256
4ba8dca8362da492f7409a842f27a261bac3ad15172f5edaebf17a3ed1cc5616

SHA512
ed843d54210e58651e7cdfa252680c43f5d7ddcb6ab679a392aa521d9ffbdbbcd6d7b5764a379d88d518bcaa55813ee2003ae2e09efdc15f584e31a4c099be01

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\Season9.json

Filesize
8KB

MD5
993d37f5e4021909da517eb92093a579

SHA1
8264d047ab3208461afbc444c5b9661ea5f94ce8

SHA256
626b8d5b3e4cefb2fec387c85e415e353ef41e99dbad66cf8ec5b98253bf3b8c

SHA512
e10c49ded7b6dd57400aaa7c354cae6370c6de01935c670cbe05eb6e42193ffaf580320692716fbb79a0e2f66d09a04df072c7758efcf643c075be519faf78ab

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\SeasonData.json

Filesize
1KB

MD5
7308745bf8101402e29488166ad223c5

SHA1
2fabde0dd870ec62c8c1fd7321843ab8859b2b29

SHA256
4f9e790f9896675cfa208894e6c873d07bb80792f37c0b041db7965a34971632

SHA512
72e1807caeaf2ea464e93fd6e288c93b20d2bf07dbf4d0eeac32ff8170534c3ab0f6d78115ca725f014e847a80bc5dc30ec79314283910d362b301abe04eb7e5

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\motdTarget.json

Filesize
2KB

MD5
83b5101ec73bcb2d46990b5f7bde99a5

SHA1
1bcc98d908d70079763b728f09e62ca3cf78a879

SHA256
4b6f850d5ef0ab4eec6c48850d65a21bc4badb988da513e8d00ca4303fa3bdfc

SHA512
ab0bd53a9809d2a35aa0574c3d850c2dc75d759b425b4b09645aca7040cc7c9c5c42dd29cad0bcbfda6eaa257b7f673085394dfd879d751611fe93f7bb066565

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\winterfestRewards.json

Filesize
3KB

MD5
07d69e1036075157f5a902e12363f334

SHA1
2f19462cdf92c7fd79b0eff06aeb8e9d0ff2355f

SHA256
4f8a87e72236380977814612fa6d3153941f63a9e47f7c76229c74c55d3f3405

SHA512
b17ccff1b9d32bc1e589e66ff25d5bfa7c5dc8a68e547fcabbcfa039ec86dcf2df9b4014545ef0d1ecff2cda3aa91973f42be8e5cd50f46545e1de7d7a03be87

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\SAC.json

Filesize
75B

MD5
c53b18caaf45ea1ebbe54c601c216aa0

SHA1
f2d17e5ebd722e8ba1a481b66a48c09ec3474d83

SHA256
e7e8b90237bf18690fe25f99c10bb63a3cdffefe123e3af8417710f94b90a29a

SHA512
fccfea9b9594365d13128f5e416a40168a6da80486a9db859cc4d02da52af4e20accdae6e949ac9622dd7e83d9e5640dae9a7b8a6b1b051e78746f4855daf847

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\catalog.json

Filesize
368KB

MD5
09032b1e224b41f6daab33be72902a4d

SHA1
4ca0b76e993127c61b7450d6718d9a807142bd64

SHA256
6791428c5fe58268ee5883d7c4b7fd7a63c0b6c57387a14b6a628738794079fe

SHA512
f6f345083db4f229c4f0f3001e6676b7e0baf37bc231a296105165d4257762cb77c2fb27f82a77672e366e3d877b1fe7935a1af5950ff8d247e693c9fd271297

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\contentpages.json

Filesize
248KB

MD5
d20fc7943ad2b681a568732d2c803b8d

SHA1
fa5349747a0054e0c4019b390fe9cde60733473b

SHA256
6ccb67c540bdb8b5783d676b87f2dce9639de47ce5a10e93dd01736847d65ad8

SHA512
f68e96d7640efc8aa5059e3db42425e26f154fef0a226ff5c5999928d91a67272262c44c533d406b04d6fb168bc9325634db9c2683fd72100d4077c8af894340

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\friendslist.json

Filesize
1KB

MD5
b25551136b5cacd360334f6f5522df60

SHA1
bf28c3ebf94afba66778b0bfff0630d6fd5e2521

SHA256
9a45398ee9a04a3e5eceb359a901b93cce824e567df83e1eec605f2d51799db2

SHA512
0368c457811dbc16bb5f68bc4348d949d34b6806e4d9a56917030f3c89c9ad62f6f5b19035974d2ef1495eb620df1c77905bf9adf2b96e201d6f145c43e91ee8

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\friendslist2.json

Filesize
1KB

MD5
5a624f999b21318c228128273e21d342

SHA1
bdd6d0e3513ca6e2fe56b401083534edd6a05464

SHA256
4f8ecc4616caec7705bb3e5082370a2b99e6b5eadaaafa8ba0ac7351bb3848f6

SHA512
462981e42aace1603e35c8a6265ed5e06a7e22f3f5f03076ac366c6f9c517e57e34e26bb363b9de56ac6f34efd15fd79f9ae11582faed6d5af948389e71fbe73

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\keychain.json

Filesize
132KB

MD5
e5e3654d5b210bbe6e20f436b6baa4a8

SHA1
9b5fb825649843a0feb490948f0dda82d39f96b3

SHA256
b25ff4bfca91bd83e989c6777a00311e2c6556462b983f8c645009ffff215c25

SHA512
7e6ba13e2107290210e7b3d2843a3557fcf3a56db91746e3d55794471cdbaa8354b32994545a688a733c1ed6940bf0f0242b417d92e0812ec5c98a34c02539d1

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\privacy.json

Filesize
63B

MD5
b9464a0d5bdfb88f237f7a9e6fed1ec6

SHA1
8e230fd5d10d9b710086e5290afc02c74fdca128

SHA256
f65f929eefaf8973e73828303e80943ceea7e4a5ade567f70ffbbbcb1dc152b2

SHA512
5f2cd5f051ea446f17265250347c766a635fc570a73956b8af6d15f9ea9a67147ecef7187617995eed9728ded17f3cc9892bb4803d56c5939483f9843aa2f30d

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\quests.json

Filesize
4.5MB

MD5
6015dbe427fce3805046bc979ed4807a

SHA1
92210c238af5e84fadd2e237f7ef6d08979a2712

SHA256
c0ae433c8b757e742629a3b0e204db45fa896836f7495e0e028e32a8f302a582

SHA512
ecefb3d86b6784aad51af27fca0e16ee638132a1411ede520f441d8da96b21f7eeeb79a04dd2ddfb347b6d66ebbedf27b2d7f1ba80410ada6990271f9c4046df

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\sdkv1.json

Filesize
19KB

MD5
d54d47d37575a3d0936cf8d5c75a59d8

SHA1
526f32ef156eb293ba0b40b6d58e0385d3053e5d

SHA256
87c9996dcbbe479cdc36a40212df2f52e278f8684fd1183bdf7488b3f4889609

SHA512
e121ae5746ef93e89711ff715c6263bdc483eda5b854227d2b9a203f0136b7c1317bd06abda27961fe9671624322647f15fd706553b2db78eb388cb67a081879

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-09JL7.tmp

Filesize
15KB

MD5
bf74d66b5e8e980eedf36a517daf8a7f

SHA1
ff02264603556c7c384801acc6e5b35119721078

SHA256
1eac9e838c57c5c0b891ded9fbf05380eae3038dac0a5112c7c47de794570356

SHA512
90a8c42958ac67a28dbd8ec35e2abe5205a982167d53c418906212c87eed61da2e4ba05237add57394abb33a1a253d595f0311a5711e03ef5c7e7c8fcee8d75a

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0CSK0.tmp

Filesize
17KB

MD5
6265b707ef237ee8c9902a29a426c49d

SHA1
779de57d390538bac295b1c1b0de4ba746192663

SHA256
bb6e58153637fc1beceba0fe2b84fd70762c2c3ecfb45c1292a0b0c245c623d1

SHA512
6e8df599dedc35e02d1889755e5e079a1ec219f2c498098472993e25345c8f78e96314af33bbbca3e04371a1288a1210d735bd18e845e06ed458d334c7ed0713

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1NJTS.tmp

Filesize
16KB

MD5
0445a0d4e1399d30aa2ea49bb24f47d8

SHA1
47ba0f43b1cc3cfb172d3b2b659232c2c80d3972

SHA256
1fef34dadb20a97f60d1468b48e015f0ebebfdd9f4d01145e2f8f6220183f67a

SHA512
19cf0a52c0b4896e8f1007848ab96a8c0866ab8ab261ec782d59440cd95be379a06e52d9f7960615af45e4786426eab2a32cd318728c78f7dbf3e53159f96da2

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6H38V.tmp

Filesize
15KB

MD5
8b1ee1d78b3734ed728326faf6afd3f1

SHA1
6531922c23410e5f60e1ae063a3cb181cc29645b

SHA256
0c63f184957f53d755efc9c7126f273c1426efccf7e8a60f6272299354e9016c

SHA512
6e51896e2616fda0f98639053a18aedbcacd174f4457466282046e4f5e063de8c84ef5b6a3c4c4078552475ea78a5c7fbf8059337240914b1bd98c2a7653fd00

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-96EJV.tmp

Filesize
15KB

MD5
99e2dc0ac952c2163a6075ab3f5897ff

SHA1
83768e83acac120f0cf6135fd41286773fd5c6b7

SHA256
7c29e9bb329912967c2f6b23add57ebeb0b93e61205c6da4fe0b1249d6d51ac4

SHA512
1936c8868815aa30df9a5ed3807457155986a9e5d1856d5d9b54a463bbae372780250c637ad48351e4d014f5c83f26f29ad9519ec570329ce76afcdff0fa6128

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9S56J.tmp

Filesize
60KB

MD5
c7d79c7c974a365649b3c332b8900ef7

SHA1
48520550b73d74e0fe27375262eaa93227ca048c

SHA256
66d0c4d6926177496b1639c4d08dfa18c95ea969bbf67da7c8ac972d92a3ac6f

SHA512
14c72ff511aafb092944ff20c648e6a456edfbe886f8969cceda17721f14ac1d52808b484c64f838aa46482ae3436092a43775ed54af92013b19bcbd304c58fc

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9UOP1.tmp

Filesize
17KB

MD5
1ec1ba6d72a4ede43cabb49b89882cd1

SHA1
a55bc279df1cda0fe7b07310557a82e8491943b4

SHA256
f4b0526568bfa0f8ec9715d29e664616128e7ef88208f50fb752a5f96d16e46a

SHA512
c457b28b8ab835bbb4610f96638534c0a9da02479bd5c6f8805e79fc1a70fef2ddb8d1e580be80b046bef53d24a9c27fb7816cd5988677a0ae61668a6b450072

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A0RRB.tmp

Filesize
29KB

MD5
a336a155c02bf59982dd5ffc427a84d9

SHA1
3f2c68f4c8789c29a837e06d6329d15a8969bd7b

SHA256
90de158e3288c7553af5367a273025fe1650ce3a02718300cb7e99128a4607a5

SHA512
82951c4c6a171aeacd6b37dc312ca2fb7278f45c526b2eda67fd72fbf4edca22e87d4d6e22e475bde55b6f5662b747f43f58c346693b75a6c01a398d25923e87

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A4DJ1.tmp

Filesize
16KB

MD5
136c7c4b6791ed01b2618eb30441392c

SHA1
4e8adf0a3f558e0b49b57ad2d74fa6e2f7e79254

SHA256
fdc7aeeb165d34242771b686978ee226dcdeda8a4914a55ed94924e76cd312c0

SHA512
8d2c12e1fc86dd0f86a5c083adf848b26b9771d89ea5bc87beed3dc01da38a09284e2c4517e609c34c79a5dda797b367c05bc980db5e1471d93c9b592cb2f4c9

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AA5AN.tmp

Filesize
15KB

MD5
ecb0a9e7387ed41ee0e2c42bb89c7b19

SHA1
282e140a98c22b4cc6c2c332a6aaeee68820302a

SHA256
4f3e36427ba8e0e869c350ef754ef4e1f569c3ba3b1299cfebe1b791a44386bd

SHA512
66294d9762d14d2d59a2b5047764b0ce0a38d7fa7ad5a5173e4ec20233d3e7a1f08e06ab1356fbdee27af77d63fa69fdb9caf2ab7e65acf82d4433fb78212da1

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AFOFK.tmp

Filesize
18KB

MD5
c21f730e59b89fd526dd593db7048ebd

SHA1
7207c42bb97f89adc86013011d0465e77d175dc3

SHA256
b617c8ec304f4518b63ee16fd04f5ef2d323025c71d88decacbbd6c2a1b9ea90

SHA512
a1cca8f6aef8bc6f5c482c573d8d198f3b68c15f59bde523ba42535facf1599f19889c081538c748adbc429a1564f3cdedb5ea2b9e3595e5802c91a249974fcd

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-B4KDN.tmp

Filesize
56KB

MD5
27e97f6b12a5b46c03bd869470c1ad02

SHA1
84f61789642d1188b422d66545e062e1a7515cf7

SHA256
b661883aa286043018d9c0f0a9c04645bad1afa11329771d3b831ff0d5e04751

SHA512
7b196af7ee84f74317e2aa6d2095be3374c4abf97ad0bf942ccc524d4a3c240935bfdf0134e72ed79ecc3044aef98b9b44da9858dc3fc8373b596de1eb8009c3

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CS1CG.tmp

Filesize
17KB

MD5
7d8251fbbb46c6f8692e4cb4b556366b

SHA1
de10de0630f02d1ca345fb55da5b62e9073d0a5f

SHA256
bce0afb8fed96dbd49d410dfa1efb60c5baa592d2c9f80123255d65968282f01

SHA512
2dbff9eeb2c5fafdc56748ab07a97ea9e47d245fd3a25a544983ac19ed530313b60f6d1bfc16cd5332d03baae2ea53c98e10a761b1081333f7197096d7962d00

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D0RBL.tmp

Filesize
17KB

MD5
b1f57db62c3295304a2f205255ed36bb

SHA1
f21fa615edb20914c62b6fc1d2e2e7c24c95a7f3

SHA256
f7df2dc844b096201ab39d104767a8ce65765eb05ac4fb7721b0266ba46cea07

SHA512
823617850ec14af719d631a0eec79c7d56a65941fe70808360c7619d612ea022c47da520b9a43476d077c8092953dd680d193fa70d0149c1abbc3c966c4adcc5

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DA2H0.tmp

Filesize
16KB

MD5
ccb277a8ba503c8994491a6df6f5a51f

SHA1
da19b05b2caf6dc97c47b865a7aa6aea35eca5fa

SHA256
a0a87358b15b7a71b13f0e8d6bea272adf8224d47fa4df81f54d2a0d5604c689

SHA512
e25078bed6bb68196c48c15a150fc8903dac8d623095e3549bbc2a9bca78f1605fb539316b51e3206822f95cfcd52c917dbe3c3757f80ff7f50e4656e2b41015

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DI84E.tmp

Filesize
16KB

MD5
c2ce31f0afbc2b9b77f6088a0e707961

SHA1
4201d69f479d97ed38d7ff37f1514a6b311746fc

SHA256
01cb98664bfc7af0278ed97f3efd05daf62f8111847e614842ea99d1f3e1a388

SHA512
a1b374c758ca5a0460be5887867b9b21fc3ab7193c2a4986d12e9c4ff8867f8d72de0c353ea39d40276077d408dce995bb083b9d948aa5a71c2a511e6e80fe27

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DP3TG.tmp

Filesize
17KB

MD5
03ea0818e97c80e8b5504fdc44fe8af1

SHA1
a32a9d0a770b2a3ac5899f22c7befcbf8536f49c

SHA256
edb16195e5cf3a22446df91b11bd4a079027b69ec5f67a1c34ca3a42d35fa549

SHA512
4cc64b4a299e4035bbaebb0894c7cf962dd0679820af769341fe4679bfc90fd052ad7f73c69688bdeb437469519177c473d1a57fee7d5874d4c309fdc436251e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E1E6D.tmp

Filesize
19KB

MD5
0033fd816c3fd2e12d7403a88f48267a

SHA1
0ec4b584ebb38819c84908f27a71085b1a3e0888

SHA256
bad6519c8e1171763cded59c37c35b4d0a2fff88d023b4ffbc4104e8886d72ad

SHA512
79ef1c528c149d2453c74bafd06a504d6eb6f347ccd322b898a0c099b8869fa0e8a757575f4631ef0be1d45094f876eef6e1c55b401fe516a89088d0b6f4a02b

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E6D58.tmp

Filesize
17KB

MD5
e16a99953a2ef9d08f70521d53c8fc28

SHA1
067eefad723ca4d9a016316a40bc542ba9a0e0a9

SHA256
e9263a6073b0b1f28fd3752b7f8d7e259678ed34fe27383c2bde127782aaa1b8

SHA512
1fb2db9f192d5a56550c315611ac6a7ae627f13e3aa3da0afba308ab8056f2d298452549d0e9a4bef7ff29312c410c23c5b2d4193796c674a1229d5c8d88185f

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EAB7G.tmp

Filesize
15KB

MD5
27e154e05b4a81306cc217ff55a632f8

SHA1
b34bede90ea62f02512e5679d4c77a47f961404f

SHA256
362417115ddaa4af90a2fe51a9e35183884748f3d17ae83fbf91957f24666948

SHA512
b4dbf3b3fd36cf3045aa8a4044f83a07de9dbd3440600b69f2dc720c61c6054c1c2f424a823d326478ed07ece226cc5210c4f87c5b7ea7603d0528bc71c72236

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EKHTN.tmp

Filesize
18KB

MD5
69f5f4ed961e71f166dfa1618db7e942

SHA1
88ac67af3136206472c1a7baac6536b9b9be0b35

SHA256
28eddc860813773da70b72e767ef321e9e93f565b480b109f4bd0e833d843f5a

SHA512
8c0a51449a2405cacc010c2f0ccb85e65c7aefac1f254c55ac372c71f7bf1647a76414de4b57ffd3f61b4619c82787b386c69ea97d0e4da307f83a73113fef33

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FNK3E.tmp

Filesize
16KB

MD5
4a2fc282b0ba63bfd56dd155c3cf097d

SHA1
4d709ac7f996de824e8855d99e34ce528ea035af

SHA256
d75027d22847787f28cd456fb5d38238e2c81df309f9f901c8d8633ce7fb29db

SHA512
d479c2ec701e9b21571776effe2e7b7d8388a0582ebdb17ff31d36507082736cafdc6f09a61501f19d6e86a607bf8e403f5a13dfdfeca0956f9290aeac8293cb

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G0ML6.tmp

Filesize
62KB

MD5
ecb670242bfea1c7e9f36eb6d95d1eb6

SHA1
aef90140bcbf299c053263b67f8a7740d0bd11bb

SHA256
71f34870e22426216427239342db20cc474fd82c4352bb4f90ec09f763e9b382

SHA512
cf46c4476e045cc24c01321868054a0cbe28d4e866910f6e1f1556dbecf1dd1ae76a514fc9772cbe8c2ce2fdfbfef3ca0cea756f6c7ce1ebfead4e3e6ae9cfe5

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GN9KS.tmp

Filesize
56KB

MD5
6c0588011ac72f7871ea5442c2bcbe62

SHA1
d7651a5e10c197a05b26d90d961f3e02fb1ae818

SHA256
4286e35151059b2adbd9373d95a425ecd69a81b5f3d6a025d25a3d6c161368a0

SHA512
336563867aeef253483e2f00c35d87f7771bd6aa38ec222237c50f9f4368b160291875789d1605ebf5ba3a292d1cf97ab62cb886bb9932ab0673d0153528a0f0

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I2EH7.tmp

Filesize
17KB

MD5
e8202caf5da9bb32d214f4d509f2940f

SHA1
29c58ef80d59b9dd6524f7d2631cd07792b54730

SHA256
65eef2918cddca4ea10c3b9ac6b8619040faaf1da5cd85840fe3fdbf89b5f47b

SHA512
75d1283c3defec504116d5eff533ddfba66466deb83bce0633fcdd7ef29d472dc54f0ac846781b5e286969d552fd252f8756fb952f4ac6e40feebc4de2563195

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IB394.tmp

Filesize
15KB

MD5
8f850a1c09d71493baea7a283d64558e

SHA1
dfabda46829f4e08f53eb87942ea2c4737ae73bb

SHA256
1c2d03cfc710ac9b87bdf01826467ccab70c7d6696069698e35812ebbdcc24ab

SHA512
85c41ccec23a047871d303957431223d318f4804b4fbc0cfe61a3fbc137fe53aa27afa723a4c055e0adcc3d92ce3b3cbd2bdd7164646a8f47e66d23226fa012c

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IPLRE.tmp

Filesize
18KB

MD5
cdf7787c446f89dacddbed2ee3758064

SHA1
64639f8c4c59ba2cd484936aee3acc04f0405df8

SHA256
d4058237dc4734445711876cb243977957297b052d188c85e7641e947fd824a8

SHA512
1a63c94625246cc1b0feda880ca6cdd047ef50b19ce4ca3237b8f3f2d76299a8e485393b4be0b7544b63456e59bf180c79e5ed2c0a17c321a118d3ffe4fa7988

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IS6L3.tmp

Filesize
31KB

MD5
776090ce18472fffc8e4038e2eadcdfb

SHA1
647cac825c47ab09a366f5a7ee13f562eabbf18c

SHA256
1b61f4d223525454a9fc99527196ff677bffd62c1914a3dfd8cd58baafc67939

SHA512
d05db5bd3c3a3b85c5f1e9a05493b479afc166006b98c994fef51d6fa19c544d5cece9fff7c96703966d429bd96b721977d23e6371134b1601466e8c90f87e66

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IU14G.tmp

Filesize
63KB

MD5
39544db54054b43ac62ce25d7e964789

SHA1
3d46a429fa5764f20a147288276e516379fdba4e

SHA256
0dca4c50c5556a7ee08b2dcfc39bb4d24285ded90cd7d8173a0c1a466eaf28d3

SHA512
dc37dc4e7912b0ce985376c0ad6ccd7bedffb3800cf69047be44d571956d253e06ec4091e428186409d3e6e2c76c7f20ea01b0a997c894fcd465748b85c483b9

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J7HG2.tmp

Filesize
29KB

MD5
62b608c1b6419632f312608335a7e9c3

SHA1
10ddd3e3fb0c7868028de1f06bd8fe33e4ad4021

SHA256
058e9b9255e713e4cf6e09eae282c72d9f852fccb02f0b90147fb2be849e3270

SHA512
3a0de7b2957e3ae6053150dbbb36025a0fca7021093818c25af0c06a38183c80e8b3a7f1a8d42b8adca516e074abc22a5d96bc4ac183ac1b7afd6ea08f849b0c

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JVVTM.tmp

Filesize
29KB

MD5
0c520483792d7ea613be99d4a920cf79

SHA1
4cb567d7af02db377e2f090b0816bed231bee874

SHA256
c9699519eb8396a8e250141fff7d4ccdd58148e86f8143407da840fc30341a94

SHA512
01ad2dfab99d419fa6f71b3fae7e1a3852556bba10738475341021198350edc42b8d239afad395eda45b5bf53a341f1e3a789331561c1d7b9c074cbb2ef253ea

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LIKIT.tmp

Filesize
59KB

MD5
87869e860759adce97e2a07e5444f478

SHA1
8fcac8f5ab7bc6aab9778a0e01ec6ab67fb45f31

SHA256
59e4d62b9f0f93bc22bbb995a91e73f1f21bc7c3099b024dfb84797916d721d1

SHA512
1099c45b862479982a3d5fe68ad3f2892f7b78636aa43007768667d40584ad99f3765c0fc11cb630561409fbb44642f9421cf6ea4162497ecd62efa8a7651db8

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MNL4B.tmp

Filesize
16KB

MD5
3b7f153d0c2d08a03549973173d57436

SHA1
bc2d86ca3dff05c76843bb96ee9ccca50891918c

SHA256
b7bab5c33a4cb40b779749b36cb5c1c17de1d174b84e46dc1d517c11693cb3a6

SHA512
ddb37bd3c1ead424b9050a69e01e8826f36f2bcfa5fe677413a13638613dbb87ec9352312a83f7d33176d70c613d6ec528d350588302bdc6cd936aac4e9bbf9a

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MOMQJ.tmp

Filesize
18KB

MD5
a311f563294e5da4480ecdc681cffe35

SHA1
8c8d000e20579aafc1555935e21a5325ebb025a9

SHA256
bb684c539dba3b9483691f672d47af5ad4b564bbaf9bcd793ebe3576cfb10ac9

SHA512
2bce6e4c40f5e76e2f64c4b5b3667b8412703beb4924f89533e28883e66893abb0fa1b44c3c43d9954f0b97e659e3447de0e2691c5eb8687bb7a03260eb93a5d

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MQAAU.tmp

Filesize
16KB

MD5
a03cb2751576fd6708d64821131e5c7e

SHA1
e19192e04d10e90a954a0950336e892ee627bcfb

SHA256
1e8b2a4f6012956a92c8e9549f253fce6af7d488a75ced764249fd815b5920dd

SHA512
84d607c146ec22fd1e24bf19323a40e896cbb2f732cc76055c2722a5ed41c19df4b6ba390dbad00601d89ed2da51537b730415670a2c4a5382c1b7f57c69324a

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MTRNR.tmp

Filesize
56KB

MD5
1d363c9639ac5041d6418997ca486564

SHA1
632029d60bfd76801223beb36f54b4cc3e6ec4ab

SHA256
dbcf02d37aea057f721339933914489cdf2c7c93699f9f109fd6f78c04d95516

SHA512
2fb95ba404ee793fcffb764b5983e89feff7b43b4ef9271b4b8fe85b90142d7eeff9c6489a9d1e224b281213078be446017334de8f1b6c27282640bec6e7ddf2

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N944J.tmp

Filesize
19KB

MD5
cfc4513b41aa487da9072a12a7e0ad52

SHA1
f600e49dfc391d52565838fb45b78c5c16d1f62b

SHA256
719206d8d18b54ac8dc6b890df14101526e5ddf4e26ca728e572cbceefad9dd0

SHA512
d0ab802a4c1d4e93ea23a46f69f11d7b3f7dd5121589fc00c7a716391ed6330eca1f25ddaaa3a4782db22246a252fb61130a7f186278399f9d79d267f96fba5b

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NBQEH.tmp

Filesize
17KB

MD5
7fb5407e0c2b5d386a106d5b2f9e3ba7

SHA1
703d96a15e3077b461ec5ac75b1754f20587869a

SHA256
c36bb2336886642f8f6bd697b21a0a98e1adf9e550f5cf1dd475ab7f34f04649

SHA512
aa659650979f659fc1dba80d6f6d1e629ff51c2e97f66f674b554051dbbb940337ca0ff47d2c9413859fac41ad919f7468b6a3ddd162ff965bbcaf9b63efc669

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NHPO6.tmp

Filesize
17KB

MD5
f00ca4d2d1623fb6e2899e7317576d06

SHA1
93fa1c8974608c2405a203816486482bf52857f1

SHA256
8b53e0b7d347aef33a8f7d3d0bd7b0a49358d0e7563576a74e8e54f0b2e17b75

SHA512
a8bd31fa219ba0302f2b36953e7518e91ebe4b2e2afc8e8625f43ff3140cf01a4df8db35d91800e404e2261433dc6891b2fa4accf45463dfc3477cfd7ef4797e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NJ7IP.tmp

Filesize
29KB

MD5
83feaf4b539212076f79f6028ed91451

SHA1
b2372198c552422d541038db80fb37028fee384d

SHA256
903bd6b70c8d8be312d91aad90cc9dbca4cb322267d7ba449b59883b3614fe5f

SHA512
60522a3e7fd67bed28552aa400e0ddf5135662a38a542be532ca63759c4cf79600c10c531046de5f7488fae3c694fdc0bc641a7b6d279efe5877534071f0ed86

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NRSDG.tmp

Filesize
16KB

MD5
e44663a4329ad578c923369c47d4f971

SHA1
4d429e36798e13227ba98ec00e99273c53fff107

SHA256
0a4b84f16995a13c36c9199ac4375b8e218833128e31872d4686df4d61057897

SHA512
18be48d75f6881035799ea388293118f5182e83158029b52621186d466bb67e17e5cb1ea4f22c8948ed951175df7f134fbec8d77826958ff6c3bc2ce9c0be3c3

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OU9MN.tmp

Filesize
63KB

MD5
836780ef5836e4acf454bb5e4d0fdf20

SHA1
b0789f4ff7d06d86c31b838ba565a8bc819b253b

SHA256
23f8fd376e725b190ed78715416259b02546b3d557c057c5b581094e89daaf50

SHA512
c23776213add6e3b86a19fb96a931c797f8a94553ccb3f68cb33b9feb5c8a9100b5813e253eeed5abdc12ca888b336f72e19f6fa89ee411ab61add727c98b673

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P1VQB.tmp

Filesize
60KB

MD5
025299c082a269d8f169cf25d11d0e7e

SHA1
319349004e0346d08f83624d379241832e642c09

SHA256
4ea0103d4becd57221e583dba1ce1d353b69b6e70f1916e5ea0f984ac32400d1

SHA512
fe1909690aefa3ae3348f0c6d02e84f409642646e5d888c3dbd7481c3c1731fbde706cb8a01af1a5762f0580a206c4048661baad51eccfdfcfb8fd541be2a27e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PTC4H.tmp

Filesize
21KB

MD5
759577ec0b59da61a03d187167b4dabc

SHA1
83874b6554bce76cb32d2ef45be7212a3c4c1c1b

SHA256
6ee0bcaddf0ddf8a24b4c92b7f0931e1f6ea48a309155c07d74934a4b1c7ece1

SHA512
3633972f36563c35600a535622ffc54d8fa341e66b01feeacd10f2479a7d135b489823dcb10dc346cdf557e00b2ba8dc8805b19fcda5aabc39a689758f386fc9

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QID87.tmp

Filesize
61KB

MD5
5c2cb4a377b8031f8fa72f72c9469129

SHA1
242613073fb7e814e3bfde28c22270302e0e3463

SHA256
632c1b5abefc65a51d8c2cbcaa21e40330560e7d5c2be892fe92bd168677c071

SHA512
766ce49666661f1c15de26f8faa3cd972f7b7af7c86588747133d03840af51bc4d028555bce21383dd9b0d040ca595394950c3136422af6ab776cb513d6945ae

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R1SHO.tmp

Filesize
17KB

MD5
dc35123c573f781934203b85cdae33cb

SHA1
27135a60075a1b72b220a6171e082dfff23afbf1

SHA256
668bbecdaa09535e30d2d7fb66c26470b680419475a118756bee4c6ad151bb31

SHA512
11a8b3ce727142cccaaa3ebea1e68fd48c0c79a3036a2e9b79d9537924ab7e0a053a8c128d3d45a43fd71c1c34e6c01ffa9afbf8cb980a6788022a4dbc28f24a

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RAAPN.tmp

Filesize
48KB

MD5
b6e86d99b76b4e73356abed32db1b71c

SHA1
61650cd290f10967747d61a63acdd09e244db772

SHA256
fc26f6e46e13715922878436d3f53d07090ec6a73d00b8fd765f86ac0c4ebc24

SHA512
f15219811402f89b3170c2c057b4ceabaa904bc98c6cb2073175fcdf8c5b2c1472854db588bee702218ed1e321e756614ddb87b57a955840443a686af7ee7ca0

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RIHNJ.tmp

Filesize
16KB

MD5
9eebdba073120807a14d142dd13d68f6

SHA1
785fcaf902d0bd1fdb9dfcb71b89e734b03bb3b7

SHA256
fd09487126e613ab0bb4d65b665f05205ff5742e25354e64b8153c5cdccef3db

SHA512
7af4b096a44235e2da9d2808abb16605ff1aaf0944c82e1dc8185eaf88c662d5214eeba554ffa737721e6fd778d41592f6972b8edfb1c00d3ca608a341b90f99

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-T44AS.tmp

Filesize
17KB

MD5
26d635787910816d372473bd9298db02

SHA1
d7a843090d40435748e18e68f607049a070f0de1

SHA256
01e079f573af0cbba9bda3f36919fc91dbd509401fd50e0d589838b50cb1dd3e

SHA512
775d74fd3b5d1ec267bf0cb14ef9be9fa4060a4f7c77fc587c8105c3bcc174d0c515fefcc9140ca48ee9b28765491d97f2f30ea40b3f0672ae90aaffac16c88e

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TA3BV.tmp

Filesize
17KB

MD5
316556663b11ec3418947eeb984b0346

SHA1
b390855c7d759ddb8a407d94b45f368375e6c6c5

SHA256
84c30fd2c5f90c56b3be3f937eccd7993a4d87defdfb4400bb9da449ee03edb3

SHA512
2033d4dcd303cfcdde9b1f52714f917cfdace5f2dbb6037900db71bb34848b2f183f398a9cf485a6153109d78bc63ce3a4fde61036bc4dab4b646f233db5f248

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-V981A.tmp

Filesize
50KB

MD5
6fcb5606c3b26afd42c61a3a5d6917ec

SHA1
8a290eb12e160dc1fe84f76cf9fab64eaa4799f8

SHA256
55d164fcbedc805169004d7caeb3784f579b9b3dfa8d72ceb08cc1994b332280

SHA512
db148d59291a7aa4f2d289c5b51198ef1a67ddef2692f3e92f9c115c4ac847d1bcc98da2f3c9b226c962667ad1565d85845034f101a37f8f5213358037e62db8

Download Submit
C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\ks_Arab_IN.json

Filesize
55KB

MD5
332dc5172ab3f99f592ab72517f280d3

SHA1
f0439fbedac697c3d31afe1d75ffb0ab086bde7c

SHA256
0a04be6e53a5ed64013834d7ea64a84407dd269835096b810546328e7602fc09

SHA512
6840443370c516a822c1369559823b2d639315710c832e02823982fd01e2c408e95082922da8bfe08fab023e30144d726a56904ea378e0a4ddbd391799bab69f

Download Submit
C:\Program Files\Reboot Launcher\data\icudtl.dat

Filesize
798KB

MD5
da48e432fe61f451154f0715b2a7b174

SHA1
51b6add0bbc4e0b5200b01deca5d009f1daf9f39

SHA256
65ea729083128dfce1c00726ba932b91aaaf5e48736b5644dd37478e5f2875ac

SHA512
5af9c1e43b52536272a575ca400a9eee830a8fcecb83bb1a490515851bef48957d8de669b9f77b8614eb586838af23385e1afce622edb82a90ec7549f882d381

Download Submit
C:\Program Files\Reboot Launcher\flutter_acrylic_plugin.dll

Filesize
74KB

MD5
f5a9b68031df6a0fbf21f657b4f81a3f

SHA1
83f5c838efa1428ecff6f960555d4b03f12e4d68

SHA256
4649e23cb03eb0d7ca7ae66131941b2a3ad7fa1fc23b975ed4174ced2c21a436

SHA512
fd762e48ec7fba6efb624e06703131120b416242427351f2ba9ba1aef4bbb19c6da4dbdfbcb376a8bd2d5e46c62572092093c7e91811bec3c219a50e64f2909a

Download Submit
C:\Program Files\Reboot Launcher\flutter_windows.dll

Filesize
17.3MB

MD5
6576073f0d38612d1b86b6edb38eaaf4

SHA1
80450c43bec49886e0b78e452d43659b2425e536

SHA256
7810c7379edd462cbd9882ecb2317774c48a43bc8a283344bf4cae1d916b82fe

SHA512
ed15b45a8afac81a256d1b41385830d3bc18d136586e0f4312b8e177f3b37b18630c8d751488953a5c584b40a35c27869a480f03697a4c9e967a43df8690ee52

Download Submit
C:\Program Files\Reboot Launcher\local_notifier_plugin.dll

Filesize
158KB

MD5
c49a627553c69eef7323438e01187c6e

SHA1
8f6fa447edeae62be8a35996f85ec9f4ccf7d3bf

SHA256
3cb6fc490c0cebb1b9608c1d8e20db2c27901c56f8aabd68002cb4e4a265eae4

SHA512
d5fb235df5d7dc9901907ec07d45f6315337def25fe9d0d4e4df3a45519ccba3fb6164454f7595ff9705d21989d1c2951093b08a17599f2c268498070c3b029d

Download Submit
C:\Program Files\Reboot Launcher\reboot_launcher.exe

Filesize
133KB

MD5
faf60290252178fb57506044738122c1

SHA1
cdf46a790aa47945ba485a83ba0ed057ec975247

SHA256
57c055e73d24f98c0114f1c631e800d0628576c1c549822070b280d031876f1f

SHA512
c3ca458cea580859a1f51ad421062e091a89771cb4f02e0e3c59f97a50732d3979ea31658d98afc9b9f33803accc8d00afb77ae382e07dd3d72e4d5e45a65b1e

Download Submit
C:\Program Files\Reboot Launcher\reboot_launcher.exp

Filesize
886B

MD5
696903fb4523d7fc5eda193cc7b8ec02

SHA1
8ba1fdb3bfe2001fd27ec08c4f56ab42f9786b68

SHA256
cdbd5aad9e81355697d3dbf7867a4c9d1f6ce1c8e3f53cf2f6948be22f25a263

SHA512
76177f483a67815fb9d7d5efe460ca9524055180b66e6dfab01036097c8979ba18e3d70a1a3984fb79c84301a9ff5b8c81b04b1a82df3940b4fadf3bf7d17960

Download Submit
C:\Program Files\Reboot Launcher\reboot_launcher.lib

Filesize
1KB

MD5
fb065f331cb20362caa11e5f7448c592

SHA1
21b2941930dbe12e9ab37764c564dfa03d4775de

SHA256
28051685f99151d3e963c208edfc118f52501280b52720fed444c47591ce4530

SHA512
72342fa3af1106da73f09a00b9e5d5ff474a867d5baca3da0db786e5f90057e26a6aed11bec46005ad8c590098bf15229990b5f376dc4e80d56cce692cdb2d03

Download Submit
C:\Program Files\Reboot Launcher\screen_retriever_plugin.dll

Filesize
95KB

MD5
21742b5389ab3a73be7cfcccd6299833

SHA1
9cbccb499a21b971c6056fdace67407bd3acb506

SHA256
cd7548aa93518e5d91af458c3a9443a30bfea453d39ce088a07f8568218d77e0

SHA512
97b8dbbc39c8ec839b8a173956ef8bf14278528640a02206146476f77e750617c866321577e59811af7e516a966e128ed89bbc779a1c952f057fc0586c992bea

Download Submit
C:\Program Files\Reboot Launcher\system_theme_plugin.dll

Filesize
96KB

MD5
2772f624b482b64cdb9b457950a7b100

SHA1
b6e39580476421f52a53f3249e430b52992bcbb5

SHA256
7aae01e16efe23aff64d953354023e4c173838645785b2886d8c8eb2ef13636c

SHA512
3315c25c6bbd110f3b1789f8a27e05b3d8f32c5afd2056e326451ba479f1107c6608d35a201c86815c8c409527dbe9c36c9b0c5bf53b045968654776f8030f3d

Download Submit
C:\Program Files\Reboot Launcher\url_launcher_windows_plugin.dll

Filesize
82KB

MD5
5b654dd08ded566bfc4dd708f96ad983

SHA1
70b7bd716a13d5278135148e56028a1af5168f7c

SHA256
33d4a6cb5fe3d441c59da7e4f71c08384c74c6dc6652d83b0fe01f7ca0b2b88c

SHA512
8506e3c126fb2812d3e3557e1017616c9721fb2a5130ee48ce2e59b0fa29202505cb0c8f698b20a39553a6d9428a5db9f3fc00a1447253e5513bd899407a8703

Download Submit
C:\Program Files\Reboot Launcher\window_manager_plugin.dll

Filesize
135KB

MD5
daf0186e108c6b586a4034cd579f7eac

SHA1
c8f4b05e15ac6e3b9e796dd6329943f82e49ab1f

SHA256
029f52988dd8b0d1e96a4f42e4a9fa07495d3b1147679ab6f6fc9e18f51a5e51

SHA512
3b767bceb7be34134091cfb1d4cc3615ab838e1c770811f5199650e64d5b5b1b43e7a01108ca3dd4baf3d31d6397796ced4c7e3793108a6342ae872dfc3db323

Download Submit
C:\Program Files\Reboot Launcher\windows_taskbar_plugin.dll

Filesize
90KB

MD5
3dae9fbc9fee487a4fa9bd26917d5cb1

SHA1
fd2885f03dbd5914cc289ff505efb92bdc909cf6

SHA256
d03a0ad2d4456c71ccc1d0944166606812fa8cf54cb8fda0c81841a70dcea2b5

SHA512
b9ef7c83f4f119496c5ea8d6e18073438d426896d76dd1721ccd0bcfae816cbae07d8e574fd377fdd47dc3d7d23ed0279be879586a9ee3d2b2cae2e8804033a9

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
41ce6cd728e8893a0387cd1d5aaf201d

SHA1
c6c5257c73d52968b03fa7a332f61f050229999c

SHA256
c6ff6212cd4c01ff44605a8339568c3ed2b9dd85c7956873ee9db592e24b654d

SHA512
73c40effe3fa0c521cdd5347e85ac142666a5a7b982d96c80f4c08c079d2f5a8d58c12644af20f27b8480040eb74b28d0696be16fc9566c02bf2d60d08839c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_okpq540l.kqm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1CAI3.tmp\reboot_launcher-9.2.5+9.2.5-windows-setup.tmp

Filesize
3.1MB

MD5
dfc14efa4a7ce9602c826a7c8230dee1

SHA1
e8c64afe7ee40e15a7c93c8bb7b8fc3331770c86

SHA256
17757f09dc28ec28750392d98939cdcc18821a3399af843f4ff8cbb7d255716d

SHA512
dacce27d89cf1042ae2626d5c20146a871597877290ca73acbc9d97b51e5f52a9baadf15cf47645894145dac0c0d9ab1dee35e7149ca16fb1f14d3b0c4917dcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E1SHF.tmp\_isetup\_setup64.tmp

Filesize
6KB

MD5
e4211d6d009757c078a9fac7ff4f03d4

SHA1
019cd56ba687d39d12d4b13991c9a42ea6ba03da

SHA256
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95

SHA512
17257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e

Download Submit
C:\Windows\Installer\e57f482.msi

Filesize
188KB

MD5
0d00edf7e9ad7cfa74f32a524a54f117

SHA1
eea03c0439475a8e4e8e9a9b271faaa554539e18

SHA256
e55a6c147daab01c66aed5e6be0c990bbed0cb78f1c0898373713343ef8556cd

SHA512
0b6730fa8d484466a1ee2a9594572fa40fb8eea4ec70b5d67f5910436ee1d07c80a029cf1f8e488a251439ac1121fd0a76a726836e4cb72dd0fe531ce9692f6a

Download Submit
C:\Windows\Temp\{41F1C7EE-05BD-404B-AB40-20551C3291C5}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{41F1C7EE-05BD-404B-AB40-20551C3291C5}\.be\VC_redist.x64.exe

Filesize
635KB

MD5
ae0540106cfd901b091d3d241e5cb4b0

SHA1
97f93b6e00a5069155a52aa5551e381b6b4221eb

SHA256
8cd998a0318f07a27f78b75edb19479f44273590e300629eff237d47643c496c

SHA512
29bb486bfdd541ba6aed7a2543ff0eb66865af737a8fb79484fb77cb412c3b357c71c16addf232c759d3c20c5e18128df43c68d1cba23f1c363fd9e0b7188177

Download Submit
C:\Windows\Temp\{98E1B812-6F5D-4AA1-BFF9-BE56E88C885F}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/1444-1645-0x0000000000440000-0x00000000004B7000-memory.dmp

Filesize
476KB

Download
memory/1568-1608-0x0000000000440000-0x00000000004B7000-memory.dmp

Filesize
476KB

Download
memory/2004-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2004-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2004-348-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2004-1691-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3352-1646-0x0000000000440000-0x00000000004B7000-memory.dmp

Filesize
476KB

Download
memory/3952-1411-0x000002CFB4350000-0x000002CFB4372000-memory.dmp

Filesize
136KB

Download
memory/4304-1521-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4304-393-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4304-1690-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads