Windows Analysis Report
reboot_launcher-9.2.7+9.2.7-windows-setup.exe

Overview

General Information

Sample name: reboot_launcher-9.2.7+9.2.7-windows-setup.exe
Analysis ID: 1526553
MD5: bfecd3cd092a3224723e48b147767880
SHA1: 5a7ace5dc9ee44d5916b1b679ee2f4cc6584007e
SHA256: e12b35bb96f789fe856cae00c7cf465bf355c8315878e502527262fff3e74fcf
Tags: exeuser-likeastar20
Infos:

Detection

Score: 34
Range: 0 - 100
Whitelisted: false
Confidence: 0%

Signatures

Multi AV Scanner detection for submitted file
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Infects executable files (exe, dll, sys, html)
Loading BitLocker PowerShell Module
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Powershell Defender Exclusion
Sigma detected: Remote Thread Creation By Uncommon Source Image
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Virustotal: Detection: 9% Perma Link
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E9EB7 DecryptFileW, 11_2_003E9EB7
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 11_2_0040F961
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E9C99 DecryptFileW,DecryptFileW, 11_2_003E9C99
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00729EB7 DecryptFileW, 12_2_00729EB7
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 12_2_0074F961
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00729C99 DecryptFileW,DecryptFileW, 12_2_00729C99
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 13_2_0027F961
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00259C99 DecryptFileW,DecryptFileW, 13_2_00259C99
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00259EB7 DecryptFileW, 13_2_00259EB7
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFF961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 21_2_00AFF961
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AD9C99 DecryptFileW,DecryptFileW, 21_2_00AD9C99
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AD9EB7 DecryptFileW, 21_2_00AD9EB7
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEF961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError, 24_2_00FEF961
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FC9C99 DecryptFileW,DecryptFileW, 24_2_00FC9C99
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FC9EB7 DecryptFileW, 24_2_00FC9EB7
Uses 32bit PE files
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\unins000.dat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-32M2F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-ETSC7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-N7O57.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-AIOBF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-ERBP0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-QKH3T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-588UL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-E4PPN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-0HMB9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-GRMMD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-0OOE8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-C996M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-F1D74.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-53Q8G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\is-980BN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\is-FPV93.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-BQ3U6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-G4LIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-OTPIR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-CHGBN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\is-53O6A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-8JL2E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-69Q3C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-4M2D9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-MJVP5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\is-4ETNP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\is-GRJ11.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-6H30I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-K4MKI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-SDJ7M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-OJEJI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-03TCA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-1RCQ6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-J4TQT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-7SE6O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-E9GB7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-LHKFR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-9IGE7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-UV8AB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-KL4C4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-4EFV9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-HREIC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-OU6I2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-JU1HN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-90VM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-QGIC3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-9A3LL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-S85IO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-KBG6E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-J7IK5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-Q09GT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-0PPQ0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-6G85L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-KP8N9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-P1F3I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-QE966.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-HEMDL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-TKMM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-DHMHB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-ELMA3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery\is-I1VS5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery\is-SND5O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-JHB20.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-OHHCE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-IGDIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-BQHEK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-5UV1A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-OUE80.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-HRQNN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-353DI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-6I9V1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-RQQBH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-K32K9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-NJ3JB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-R06ER.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\icons Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\icons\is-7QIPN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-64EMB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-T1P4M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-UNG8J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-LNQ9D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-9H4FM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-EGNQB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-H727V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-LGF59.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-31JM1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\fonts\is-58613.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts\is-FSKCN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts\is-E11C3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\assets\is-FR435.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\fonts\is-GK2PM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JCPQK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DC8GK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CM3KP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-84BOR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FJUPE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6VPPJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2LKCM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P237B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U06KS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-55U1P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KVQGJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P9M1T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1K9SM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RK7NT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J7AA9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GQ1P9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SJK4L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G78UO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RLM7F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J8QI9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M724H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NR9D2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-16SPU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BBH5I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PAVO1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CHSDH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G5MND.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-15OVU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QM5UT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AKMV0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LP4PL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DCE25.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U9OSU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A55K5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LITUD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IDR0U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RQ5PS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I92JO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0ET7E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TEV52.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9111E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-C4BOI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8JFQF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ODKB8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q843C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2FOHA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M3318.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UNL48.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FTBJF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3SG0P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7EI9J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E72KR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GVL9E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4KUTM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HOL55.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LJALP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PKU12.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6ADIQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RQD9P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A7DJP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DOVQ3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HVLUS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NOKH4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MD4FK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6LFO8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R0PKL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6QAP1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PT6U1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RIS39.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7NNQT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QG435.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U4H7O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CIA6V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5E3CA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESMLA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7EA9I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-V0KJ2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LBONN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1E8P8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L39K7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3I8R9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-82JVQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FOUSM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9DTCE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4O5NC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4N6RB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I29HD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RJGB0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5TP34.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1MEL3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CDJD4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SIFSK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1VTU9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S8ABP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QPF9K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0LI22.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1CQCI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4FGI6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2U64K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7BRG3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6STLN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R65F1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VT4VT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2M5FF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QKU5H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-77GT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2HB16.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7P3ST.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-30NBO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FMKB4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AGNI8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q4B96.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2N7S2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GI0RQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3EO0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AUMP1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RNFEA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-74D60.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PFLUL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E7E56.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UECU6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S2BKC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0T51G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESBQE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KLSBE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-O505M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KBH34.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JL2PH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VSKPR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PHMCN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L0C18.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E34N6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A76H5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6UNG6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-09RTL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L77S6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HPOT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-650AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MN8U2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LBD58.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TR8DD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3ENBG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N2BC8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6I634.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L14LS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VJ2KR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PPPLU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3AQQK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KKEE8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1ETTL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VSMCT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QG4D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FVLI8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HAGGK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GMU6S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IADD9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7LN1K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AS3CJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AELTK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9B2M0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G1R05.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RNN48.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GIOES.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BSEJ9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6GILJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BRPUB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BQ4SD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2B4DT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-T1MDL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LATLL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N4CBU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6II2J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BJ3O3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P2DOT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TB077.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5K623.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UKR8M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5U5AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IJVS2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DJLH6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2LUN5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FP529.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TL6S4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9828K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JQEV9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RR99T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BOQT8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-II0L4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1AA0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G400F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JIPP3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E6TNF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S98VF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R1UOO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HN7DG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9154C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-H7U30.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-H7OPG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J1RS4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P574J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JTIN6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6DKTD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7UHAP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CBUKT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CR5BP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FG3JA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-42I37.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L1N62.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-077KG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2RKTT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M76J5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FAISP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DIS93.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KLEJU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BL3CC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VRGHR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FNL5B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KH206.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QGN4J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LOHHV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CEH90.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q321C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MNOLJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-17VTT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BFQNP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M0PA9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SVKT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OAKAE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KC4PE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4T01K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-74SSS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-B8S0A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QE9PO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9HI26.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5RJQL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I4US8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6M98F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S64QN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2GT07.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-525F1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MT5P9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-43TDT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LD9R9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OGUTC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HI341.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P66IJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-387TK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VG701.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M044D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IO6JF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TSESV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SJC3P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OD8Q5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HFLF9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BDEJ3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JTL9C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-12C92.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PKIOQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VDSTN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N285H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EC2OS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R5RMP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PN3UK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CPF11.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-14NLA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DB13V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-61FRH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TQUOJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2NBE4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-B2TF3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0DSU7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OCSSV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SBHN3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5VAQU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9G5KD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3O5IV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VAF7V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CTOU8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UAGFS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5HHJ8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5CNSF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CD33N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-F9U6B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-27SAK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P1CKB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LG6A6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PJNHJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A79PR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-STPJC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1DN4B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EJRFB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D1CLK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I6K1A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESNOU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SSD1C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KAC6O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-51O9S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UUE2O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M61DD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FRA9U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-F17SQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UKPGG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M1DT6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-499FU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6N7DT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J694V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-K9LUH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M1ITH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S2SKS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5UHMS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N7P33.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HQSBF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-96CDG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LS3H0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0N10N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SBE6F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6LONH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RR0I2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PQFH2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QK9FA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-REUMM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NCICR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8JCHV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CHDQN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7AKIN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1C083.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-38K53.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QUVHE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FM7ND.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A04UG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SF4G8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-33DG8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U6QKG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FQ4UT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-C3BT6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GEN7T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8L2TN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-514C0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-03MPK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UUIT4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1I7AQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QSSH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8RTNB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6NJ8M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P5TNI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-21JR9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SHJC2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R3DNA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U593N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GMG6V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L1IHI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E409O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LINJ0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-K1GIC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JUC5I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IBNKP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9N0D5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QE147.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VVL9R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SAL15.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N31TV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OKHN9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NIL44.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D0KBJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7AVL6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E1BQA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RRIU6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N4I4S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HA06G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-388G0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VO45O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OGHHN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TVB9O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0L6F6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EIQCJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-932AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PK7QK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2A02I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5NH8E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-956T4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QPOS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MP18S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4OSJ2.tmp Jump to behavior
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore SRInitDone
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\31868Auties00.RebootLauncher_is1
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-06 #001.txt Jump to behavior
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1028\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1029\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1031\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1036\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1040\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1041\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1042\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1045\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1046\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1049\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1055\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\2052\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\3082\license.rtf
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 0000000B.00000000.1987483297.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000B.00000002.2247376757.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000C.00000002.2242256022.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000C.00000000.1990296299.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000D.00000002.2234118073.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000000.1997889725.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000003.2125283661.0000000000783000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.2231545564.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000016.00000002.2226542892.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000017.00000002.2223009875.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000018.00000002.2227585349.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000018.00000000.2221307095.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000000.2223194043.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000002.2450011762.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000002.2445411513.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000000.2225191583.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000002.2439073159.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000000.2323003797.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: c:\zlib-dll\Release\isunzlib.pdb source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp

Spreading
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140kor.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140jpn.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_2.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140esn.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140ita.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140deu.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140u.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140chs.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfcm140u.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140enu.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\concrt140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140fra.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_codecvt_ids.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vccorlib140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcamp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcruntime140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcruntime140_1.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcomp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_atomic_wait.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_1.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140cht.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140rus.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfcm140.dll
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 11_2_003D3BC3
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00414315 FindFirstFileW,FindClose, 11_2_00414315
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 11_2_003E993E
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00754315 FindFirstFileW,FindClose, 12_2_00754315
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0072993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 12_2_0072993E
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00713BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 12_2_00713BC3
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00284315 FindFirstFileW,FindClose, 13_2_00284315
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0025993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 13_2_0025993E
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00243BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 13_2_00243BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AC3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 21_2_00AC3BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00B04315 FindFirstFileW,FindClose, 21_2_00B04315
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AD993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 21_2_00AD993E
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FF4315 FindFirstFileW,FindClose, 24_2_00FF4315
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FC993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 24_2_00FC993E
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FB3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 24_2_00FB3BC3
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\NULL
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL
Source: VC_redist.x64.exe String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: VC_redist.x64.exe, 0000000B.00000000.1987483297.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000B.00000002.2247376757.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000C.00000002.2242256022.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000C.00000000.1990296299.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000D.00000002.2234118073.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000000.1997889725.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000003.2125283661.0000000000783000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.2231545564.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000016.00000002.2226542892.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000017.00000002.2223009875.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000018.00000002.2227585349.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000018.00000000.2221307095.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000000.2223194043.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000002.2450011762.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000002.2445411513.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000000.2225191583.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000002.2439073159.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000000.2323003797.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: powershell.exe, 00000008.00000002.1966247535.0000019E11C7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01E39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01E39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01E39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://subca.ocsp-certum.com01
Source: VC_redist.x64.exe, 0000000C.00000002.2243956856.0000000002C60000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 0000000C.00000002.2244462546.0000000003180000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000002.2228919365.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000002.2229318602.0000000003730000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001A.00000002.2446330540.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001A.00000002.2445861450.0000000002A10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: VC_redist.x64.exe, 0000000C.00000002.2244462546.0000000003180000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 00000016.00000002.2229318602.0000000003730000.00000004.00000800.00020000.00000000.sdmp, VC_redist.x64.exe, 0000001A.00000002.2446330540.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010Hd
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01E39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.certum.pl/CPS0
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01C11000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.1966247535.0000019E11C7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1966247535.0000019E11C7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1966247535.0000019E11C7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2330552751.0000000002416000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Auties00
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1685929712.0000000002550000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/Auties006https://github.com/Auties006https://github.com/Auties00
Source: powershell.exe, 00000008.00000002.1943978048.0000019E01E39000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jrsoftware.org/
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000008.00000002.1966247535.0000019E11C7F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0D
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.certum.pl/CPS0
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1686888566.0000000002550000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1687294325.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000000.1688802188.0000000000401000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.innosetup.com/
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1686888566.0000000002550000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1687294325.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000000.1688802188.0000000000401000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.remobjects.com/ps
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49780b.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI7C60.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI7D7B.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\concrt140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\msvcp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\msvcp140_1.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\msvcp140_2.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\msvcp140_atomic_wait.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\msvcp140_codecvt_ids.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vcamp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vccorlib140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vcomp140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vcruntime140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vcruntime140_1.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\vcruntime140_threads.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49781b.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49781b.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49781c.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8674.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{59CED48F-EBFE-480C-8A38-FC079C2BEC0F}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI87CD.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140chs.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140cht.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140deu.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140enu.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140esn.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140fra.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140ita.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140jpn.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140kor.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140rus.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfc140u.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfcm140.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\system32\mfcm140u.dll
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49782f.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\49782f.msi
Deletes files inside the Windows folder
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe File deleted: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BB930E9 8_2_00007FFD9BB930E9
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FC0FA 11_2_003FC0FA
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D6184 11_2_003D6184
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040022D 11_2_0040022D
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040A3B0 11_2_0040A3B0
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00400662 11_2_00400662
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003DA7EF 11_2_003DA7EF
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040A85E 11_2_0040A85E
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FF919 11_2_003FF919
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E69CC 11_2_003E69CC
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00400A97 11_2_00400A97
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00402B21 11_2_00402B21
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040ED4C 11_2_0040ED4C
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00402D50 11_2_00402D50
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FFE15 11_2_003FFE15
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_007269CC 12_2_007269CC
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073C0FA 12_2_0073C0FA
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00716184 12_2_00716184
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074022D 12_2_0074022D
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074A3B0 12_2_0074A3B0
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00740662 12_2_00740662
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0071A7EF 12_2_0071A7EF
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074A85E 12_2_0074A85E
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073F919 12_2_0073F919
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00740A97 12_2_00740A97
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00742B21 12_2_00742B21
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00742D50 12_2_00742D50
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074ED4C 12_2_0074ED4C
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073FE15 12_2_0073FE15
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026C0FA 13_2_0026C0FA
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00246184 13_2_00246184
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027022D 13_2_0027022D
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027A3B0 13_2_0027A3B0
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00270662 13_2_00270662
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0024A7EF 13_2_0024A7EF
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027A85E 13_2_0027A85E
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026F919 13_2_0026F919
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_002569CC 13_2_002569CC
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00270A97 13_2_00270A97
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00272B21 13_2_00272B21
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027ED4C 13_2_0027ED4C
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00272D50 13_2_00272D50
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026FE15 13_2_0026FE15
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEC0FA 21_2_00AEC0FA
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AC6184 21_2_00AC6184
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF022D 21_2_00AF022D
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFA3B0 21_2_00AFA3B0
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF0662 21_2_00AF0662
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00ACA7EF 21_2_00ACA7EF
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFA85E 21_2_00AFA85E
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AD69CC 21_2_00AD69CC
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEF919 21_2_00AEF919
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF0A97 21_2_00AF0A97
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF2B21 21_2_00AF2B21
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFED4C 21_2_00AFED4C
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF2D50 21_2_00AF2D50
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEFE15 21_2_00AEFE15
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDC0FA 24_2_00FDC0FA
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FB6184 24_2_00FB6184
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE022D 24_2_00FE022D
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEA3B0 24_2_00FEA3B0
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE0662 24_2_00FE0662
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FBA7EF 24_2_00FBA7EF
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEA85E 24_2_00FEA85E
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FC69CC 24_2_00FC69CC
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDF919 24_2_00FDF919
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE0A97 24_2_00FE0A97
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE2B21 24_2_00FE2B21
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE2D50 24_2_00FE2D50
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEED4C 24_2_00FEED4C
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDFE15 24_2_00FDFE15
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: String function: 0041061A appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: String function: 0041012F appears 678 times
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: String function: 003D1F20 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: String function: 003D37D3 appears 496 times
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: String function: 004131C7 appears 85 times
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: String function: 00FF012F appears 678 times
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: String function: 00FB37D3 appears 496 times
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: String function: 00FF31C7 appears 83 times
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: String function: 00FB1F20 appears 54 times
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: String function: 00FF061A appears 34 times
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: String function: 00711F20 appears 54 times
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: String function: 007531C7 appears 84 times
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: String function: 007137D3 appears 496 times
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: String function: 0075061A appears 34 times
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: String function: 0075012F appears 678 times
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: String function: 0028061A appears 34 times
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: String function: 0028012F appears 678 times
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: String function: 002437D3 appears 496 times
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: String function: 002831C7 appears 85 times
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: String function: 00241F20 appears 54 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: String function: 00AC1F20 appears 54 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: String function: 00B031C7 appears 83 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: String function: 00AC37D3 appears 496 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: String function: 00B0061A appears 34 times
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: String function: 00B0012F appears 678 times
PE file contains executable resources (Code or Archives)
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-32M2F.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-R06ER.tmp.1.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: mfc140jpn.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140kor.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140esn.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140chs.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140rus.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140fra.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140deu.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140ita.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140cht.dll.19.dr Static PE information: No import functions for PE file found
Source: mfc140enu.dll.19.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1686888566.0000000002648000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs reboot_launcher-9.2.7+9.2.7-windows-setup.exe
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000000.1685451105.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs reboot_launcher-9.2.7+9.2.7-windows-setup.exe
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe, 00000000.00000003.1687294325.000000007FE35000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs reboot_launcher-9.2.7+9.2.7-windows-setup.exe
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Binary or memory string: OriginalFileName vs reboot_launcher-9.2.7+9.2.7-windows-setup.exe
Uses 32bit PE files
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: sus34.spre.evad.winEXE@33/1549@0/0
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040FD20 FormatMessageW,GetLastError,LocalFree, 11_2_0040FD20
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 11_2_003D44E9
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_007144E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 12_2_007144E9
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_002444E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 13_2_002444E9
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AC44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 21_2_00AC44E9
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FB44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle, 24_2_00FB44E9
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00412F23 GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess, 11_2_00412F23
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003F6945 ChangeServiceConfigW,GetLastError, 11_2_003F6945
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3052:120:WilError_03
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe File created: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: cabinet.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: msi.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: version.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: wininet.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: comres.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: clbcatq.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: msasn1.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: crypt32.dll 11_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Command line argument: feclient.dll 11_2_003D1070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: cabinet.dll 12_2_00711070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: version.dll 12_2_00711070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: wininet.dll 12_2_00711070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: comres.dll 12_2_00711070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: clbcatq.dll 12_2_00711070
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Command line argument: feclient.dll 12_2_00711070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: cabinet.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: msi.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: version.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: wininet.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: comres.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: clbcatq.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: msasn1.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: crypt32.dll 13_2_00241070
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Command line argument: feclient.dll 13_2_00241070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: cabinet.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: msi.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: version.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: wininet.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: comres.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: clbcatq.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: msasn1.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: crypt32.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Command line argument: feclient.dll 21_2_00AC1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: cabinet.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: msi.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: version.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: wininet.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: comres.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: clbcatq.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: msasn1.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: crypt32.dll 24_2_00FB1070
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Command line argument: feclient.dll 24_2_00FB1070
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File read: C:\Program Files\desktop.ini
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Virustotal: Detection: 9%
Source: VC_redist.x64.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x64.exe String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe File read: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: unknown Process created: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe "C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe"
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp "C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp" /SL5="$1041A,72047000,832512,C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe "C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe" /quiet
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Process created: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe" -burn.filehandle.attached=656 -burn.filehandle.self=664 /quiet
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Process created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe "C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{31F03EA9-3FAC-45C1-A4D9-19C552C12E15} {D265F6B3-B186-4C52-AD19-91A4547F599C} 3128
Source: unknown Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=640 -burn.filehandle.self=652 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BC4D612D-97C1-4D64-B019-2A3ABED83EE2} {0FE451CC-9FDC-4D3A-86C0-92B00C85195E} 5292
Source: unknown Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /burn.log.append "C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=540 /quiet /burn.log.append "C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0BB228CA-A340-4A6D-91F4-FEA2B7969EA9} {A3020AEC-E53F-4BEF-9367-F626A3FBA529} 1856
Source: unknown Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
Source: C:\Windows\System32\SrTasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Process created: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp "C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp" /SL5="$1041A,72047000,832512,C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe "C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe" /quiet
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Process created: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe" -burn.filehandle.attached=656 -burn.filehandle.self=664 /quiet
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Process created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe "C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{31F03EA9-3FAC-45C1-A4D9-19C552C12E15} {D265F6B3-B186-4C52-AD19-91A4547F599C} 3128
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=640 -burn.filehandle.self=652 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BC4D612D-97C1-4D64-B019-2A3ABED83EE2} {0FE451CC-9FDC-4D3A-86C0-92B00C85195E} 5292
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" /quiet /burn.log.append "C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=540 /quiet /burn.log.append "C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: feclient.dll
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Section loaded: iertutil.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: version.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: feclient.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: iertutil.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: msimg32.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: windowscodecs.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: explorerframe.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: riched20.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: usp10.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: msls31.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: textshaping.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: propsys.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: edputil.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: urlmon.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: srvcli.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: netutils.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: sspicli.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: appresolver.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: bcp47langs.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: slc.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: userenv.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: sppc.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: version.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: srclient.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: spp.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: powrprof.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: vssapi.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: vsstrace.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: umpdc.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: usoapi.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: sxproxy.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: cryptsp.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: rsaenh.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: feclient.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: iertutil.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: srpapi.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: tsappcmp.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: netapi32.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: wkscli.dll
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Section loaded: netutils.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vss_ps.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msimg32.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: textshaping.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: propsys.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: edputil.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: urlmon.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: srvcli.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: netutils.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sspicli.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: appresolver.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: slc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: userenv.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sppc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: aclayers.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: srclient.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: spp.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: powrprof.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: vssapi.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: vsstrace.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: umpdc.dll
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Section loaded: usoapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msimg32.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: textshaping.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: propsys.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: edputil.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: urlmon.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: srvcli.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: netutils.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: sspicli.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: appresolver.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: bcp47langs.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: slc.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: userenv.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: sppc.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: pcacli.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: sfc_os.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: srclient.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: spp.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: powrprof.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: vssapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: vsstrace.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: umpdc.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: usoapi.dll
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Section loaded: sxproxy.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exe Section loaded: vss_ps.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32
Source: Reboot Launcher.lnk.1.dr LNK file: ..\..\..\..\..\Program Files\Reboot Launcher\reboot_launcher.exe
Source: Reboot Launcher.lnk0.1.dr LNK file: ..\..\..\Program Files\Reboot Launcher\reboot_launcher.exe
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Window found: window name: TMainForm
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Window detected: Number of UI elements: 23
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Window detected: Number of UI elements: 23
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Window detected: Number of UI elements: 23
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\unins000.dat Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-32M2F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-ETSC7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-N7O57.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-AIOBF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-ERBP0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-QKH3T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-588UL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-E4PPN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-0HMB9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-GRMMD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-0OOE8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-C996M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-F1D74.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\is-53Q8G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\is-980BN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\is-FPV93.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-BQ3U6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-G4LIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-OTPIR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\is-CHGBN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\is-53O6A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-8JL2E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-69Q3C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-4M2D9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\CloudStorage\is-MJVP5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\is-4ETNP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\Config\is-GRJ11.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-6H30I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-K4MKI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-SDJ7M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-OJEJI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-03TCA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-1RCQ6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-J4TQT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-7SE6O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-E9GB7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-LHKFR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-9IGE7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\profiles\is-UV8AB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-KL4C4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-4EFV9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-HREIC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-OU6I2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-JU1HN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-90VM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-QGIC3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-9A3LL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\is-S85IO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-KBG6E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-J7IK5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\is-Q09GT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-0PPQ0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-6G85L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-KP8N9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-P1F3I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-QE966.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-HEMDL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-TKMM7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-DHMHB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\BattlePass\is-ELMA3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery\is-I1VS5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Athena\Discovery\is-SND5O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-JHB20.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-OHHCE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-IGDIU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-BQHEK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-5UV1A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-OUE80.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\Campaign\is-HRQNN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-353DI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-6I9V1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\responses\CloudDir\is-RQQBH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-K32K9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-NJ3JB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-R06ER.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\icons Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\icons\is-7QIPN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-64EMB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-T1P4M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-UNG8J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-LNQ9D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-9H4FM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-EGNQB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-H727V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-LGF59.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\images\is-31JM1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\fonts\is-58613.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts\is-FSKCN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluentui_system_icons\fonts\is-E11C3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\assets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\assets\is-FR435.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\fonts Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\fluent_ui\fonts\is-GK2PM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JCPQK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DC8GK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CM3KP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-84BOR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FJUPE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6VPPJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2LKCM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P237B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U06KS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-55U1P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KVQGJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P9M1T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1K9SM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RK7NT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J7AA9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GQ1P9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SJK4L.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G78UO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RLM7F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J8QI9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M724H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NR9D2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-16SPU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BBH5I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PAVO1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CHSDH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G5MND.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-15OVU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QM5UT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AKMV0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LP4PL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DCE25.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U9OSU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A55K5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LITUD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IDR0U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RQ5PS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I92JO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0ET7E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TEV52.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9111E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-C4BOI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8JFQF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ODKB8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q843C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2FOHA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M3318.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UNL48.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FTBJF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3SG0P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7EI9J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E72KR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GVL9E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4KUTM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HOL55.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LJALP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PKU12.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6ADIQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RQD9P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A7DJP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DOVQ3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HVLUS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NOKH4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MD4FK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6LFO8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R0PKL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6QAP1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PT6U1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RIS39.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7NNQT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QG435.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U4H7O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CIA6V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5E3CA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESMLA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7EA9I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-V0KJ2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LBONN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1E8P8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L39K7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3I8R9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-82JVQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FOUSM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9DTCE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4O5NC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4N6RB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I29HD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RJGB0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5TP34.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1MEL3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CDJD4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SIFSK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1VTU9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S8ABP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QPF9K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0LI22.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1CQCI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4FGI6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2U64K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7BRG3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6STLN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R65F1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VT4VT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2M5FF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QKU5H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-77GT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2HB16.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7P3ST.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-30NBO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FMKB4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AGNI8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q4B96.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2N7S2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GI0RQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3EO0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AUMP1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RNFEA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-74D60.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PFLUL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E7E56.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UECU6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S2BKC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0T51G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESBQE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KLSBE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-O505M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KBH34.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JL2PH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VSKPR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PHMCN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L0C18.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E34N6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A76H5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6UNG6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-09RTL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L77S6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HPOT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-650AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MN8U2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LBD58.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TR8DD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3ENBG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N2BC8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6I634.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L14LS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VJ2KR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PPPLU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3AQQK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KKEE8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1ETTL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VSMCT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QG4D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FVLI8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HAGGK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GMU6S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IADD9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7LN1K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AS3CJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-AELTK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9B2M0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G1R05.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RNN48.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GIOES.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BSEJ9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6GILJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BRPUB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BQ4SD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2B4DT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-T1MDL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LATLL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N4CBU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6II2J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BJ3O3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P2DOT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TB077.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5K623.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UKR8M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5U5AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IJVS2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DJLH6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2LUN5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FP529.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TL6S4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9828K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JQEV9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RR99T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BOQT8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-II0L4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1AA0Q.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-G400F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JIPP3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E6TNF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S98VF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R1UOO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HN7DG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9154C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-H7U30.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-H7OPG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J1RS4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P574J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JTIN6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6DKTD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7UHAP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CBUKT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CR5BP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FG3JA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-42I37.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L1N62.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-077KG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2RKTT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M76J5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FAISP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DIS93.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KLEJU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BL3CC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VRGHR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FNL5B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KH206.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QGN4J.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LOHHV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CEH90.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-Q321C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MNOLJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-17VTT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BFQNP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M0PA9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SVKT3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OAKAE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KC4PE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4T01K.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-74SSS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-B8S0A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QE9PO.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9HI26.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5RJQL.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I4US8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6M98F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S64QN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2GT07.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-525F1.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MT5P9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-43TDT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LD9R9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OGUTC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HI341.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P66IJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-387TK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VG701.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M044D.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IO6JF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TSESV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SJC3P.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OD8Q5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HFLF9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-BDEJ3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JTL9C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-12C92.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PKIOQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VDSTN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N285H.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EC2OS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R5RMP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PN3UK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CPF11.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-14NLA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-DB13V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-61FRH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TQUOJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2NBE4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-B2TF3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0DSU7.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OCSSV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SBHN3.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5VAQU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9G5KD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-3O5IV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VAF7V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CTOU8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UAGFS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5HHJ8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5CNSF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CD33N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-F9U6B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-27SAK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P1CKB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LG6A6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PJNHJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A79PR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-STPJC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1DN4B.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EJRFB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D1CLK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-I6K1A.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-ESNOU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SSD1C.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-KAC6O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-51O9S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UUE2O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M61DD.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FRA9U.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-F17SQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UKPGG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M1DT6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-499FU.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6N7DT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-J694V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-K9LUH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-M1ITH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-S2SKS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5UHMS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N7P33.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HQSBF.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-96CDG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LS3H0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0N10N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SBE6F.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6LONH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RR0I2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PQFH2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QK9FA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-REUMM.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NCICR.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8JCHV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-CHDQN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7AKIN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1C083.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-38K53.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QUVHE.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FM7ND.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-A04UG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SF4G8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-33DG8.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U6QKG.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-FQ4UT.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-C3BT6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GEN7T.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8L2TN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-514C0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-03MPK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-UUIT4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-1I7AQ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QSSH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-8RTNB.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-6NJ8M.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-P5TNI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-21JR9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SHJC2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-R3DNA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-U593N.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-GMG6V.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-L1IHI.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E409O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-LINJ0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-K1GIC.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-JUC5I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-IBNKP.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-9N0D5.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-QE147.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VVL9R.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-SAL15.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N31TV.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OKHN9.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-NIL44.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-D0KBJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-7AVL6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-E1BQA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-RRIU6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-N4I4S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-HA06G.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-388G0.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-VO45O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-OGHHN.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-TVB9O.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0L6F6.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-EIQCJ.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-932AS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-PK7QK.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-2A02I.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-5NH8E.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-956T4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-0QPOS.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-MP18S.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Directory created: C:\Program Files\Reboot Launcher\data\flutter_assets\packages\flutter_localized_locales\data\is-4OSJ2.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\31868Auties00.RebootLauncher_is1
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static file information: File size 72911977 > 1048576
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: VC_redist.x64.exe, 0000000B.00000000.1987483297.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000B.00000002.2247376757.000000000041B000.00000002.00000001.01000000.0000000D.sdmp, VC_redist.x64.exe, 0000000C.00000002.2242256022.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000C.00000000.1990296299.000000000075B000.00000002.00000001.01000000.0000000F.sdmp, VC_redist.x64.exe, 0000000D.00000002.2234118073.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000000.1997889725.000000000028B000.00000002.00000001.01000000.00000012.sdmp, VC_redist.x64.exe, 0000000D.00000003.2125283661.0000000000783000.00000004.00000020.00020000.00000000.sdmp, VC_redist.x64.exe, 00000015.00000002.2231545564.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000016.00000002.2226542892.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000017.00000002.2223009875.0000000000B0B000.00000002.00000001.01000000.00000016.sdmp, VC_redist.x64.exe, 00000018.00000002.2227585349.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000018.00000000.2221307095.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000000.2223194043.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 00000019.00000002.2450011762.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000002.2445411513.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001A.00000000.2225191583.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000002.2439073159.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp, VC_redist.x64.exe, 0000001D.00000000.2323003797.0000000000FFB000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: c:\zlib-dll\Release\isunzlib.pdb source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.1690134647.00000000034F5000.00000004.00001000.00020000.00000000.sdmp, reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2326446950.0000000003791000.00000004.00001000.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: concrt140.dll.19.dr Static PE information: 0x9D4F57BC [Tue Aug 19 13:25:16 2053 UTC]
PE file contains sections with non-standard names
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.exe Static PE information: section name: .didata
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp.0.dr Static PE information: section name: .didata
Source: VC_redist.x64.exe.1.dr Static PE information: section name: .wixburn
Source: is-32M2F.tmp.1.dr Static PE information: section name: .didata
Source: is-ERBP0.tmp.1.dr Static PE information: section name: _RDATA
Source: is-53O6A.tmp.1.dr Static PE information: section name: _RDATA
Source: is-R06ER.tmp.1.dr Static PE information: section name: _RDATA
Source: VC_redist.x64.exe.11.dr Static PE information: section name: .wixburn
Source: VC_redist.x64.exe.12.dr Static PE information: section name: .wixburn
Source: VC_redist.x64.exe.13.dr Static PE information: section name: .wixburn
Source: vcruntime140.dll.19.dr Static PE information: section name: fothk
Source: vcruntime140.dll.19.dr Static PE information: section name: _RDATA
Source: mfc140.dll.19.dr Static PE information: section name: .didat
Source: mfc140u.dll.19.dr Static PE information: section name: .didat
Source: mfcm140.dll.19.dr Static PE information: section name: .nep
Source: mfcm140u.dll.19.dr Static PE information: section name: .nep
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9B9AD2A5 pushad ; iretd 8_2_00007FFD9B9AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC271C pushad ; retf 8_2_00007FFD9BAC2749
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC2705 push eax; retf 8_2_00007FFD9BAC2719
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC2644 push cs; retf 8_2_00007FFD9BAC26A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC2634 push cs; retf 8_2_00007FFD9BAC26A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC0952 push E95B59D0h; ret 8_2_00007FFD9BAC09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BAC3544 pushfd ; retf 8_2_00007FFD9BAC3552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 8_2_00007FFD9BB92316 push 8B485F92h; iretd 8_2_00007FFD9BB9231B
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE876 push ecx; ret 11_2_003FE889
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073E876 push ecx; ret 12_2_0073E889
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026E876 push ecx; ret 13_2_0026E889
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEE876 push ecx; ret 21_2_00AEE889
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDE876 push ecx; ret 24_2_00FDE889

Persistence and Installation Behavior
barindex
Infects executable files (exe, dll, sys, html)
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140kor.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140jpn.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_2.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140esn.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140ita.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140deu.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140u.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140chs.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfcm140u.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140enu.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\concrt140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140fra.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_codecvt_ids.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vccorlib140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcamp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcruntime140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcruntime140_1.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\vcomp140.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_atomic_wait.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\msvcp140_1.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140cht.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfc140rus.dll
Source: C:\Windows\System32\msiexec.exe System file written: C:\Windows\System32\mfcm140.dll
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140esn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140ita.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\system_theme_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140deu.dll Jump to dropped file
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497822.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-R06ER.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497812.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140chs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfcm140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49782b.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140enu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497825.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-32M2F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\local_notifier_plugin.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe File created: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140fra.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497815.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\url_launcher_windows_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49781a.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\lawinserver.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-C996M.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\flutter_windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-ERBP0.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497824.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497814.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcomp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\winrar.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140cht.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\app_links_plugin.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\reboot_launcher.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140rus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfcm140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497823.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497813.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49782a.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140kor.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497826.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-F1D74.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-QKH3T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-53Q8G.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49780f.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\flutter_acrylic_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140_threads.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497816.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497820.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-0OOE8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-GRMMD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497829.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49782c.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497819.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497821.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\window_manager_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497811.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcamp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\is-53O6A.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497828.rbf (copy) Jump to dropped file
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Jump to dropped file
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 49782d.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\screen_retriever_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497818.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-ETSC7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-588UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-K32K9.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497817.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe File created: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: 497827.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\is-AIOBF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_1.dll Jump to dropped file
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\windows_taskbar_plugin.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\7zip.exe (copy) Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\wixstdba.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140kor.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140esn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140ita.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140deu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140u.dll Jump to dropped file
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140_threads.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140chs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfcm140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140enu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140fra.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vccorlib140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcamp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcruntime140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\vcomp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe File created: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\msvcp140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140cht.dll Jump to dropped file
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfc140rus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\System32\mfcm140.dll Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-06 #001.txt Jump to behavior
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1028\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1029\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1031\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1036\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1040\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1041\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1042\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1045\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1046\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1049\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\1055\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\2052\license.rtf
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe File created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe File created: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\3082\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1028\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1029\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1031\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1036\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1040\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1041\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1042\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1045\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1046\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1049\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\1055\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\2052\license.rtf
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe File created: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\3082\license.rtf
Creates or modifies windows services
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Modifies existing windows services
Source: C:\Windows\System32\SrTasks.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reboot Launcher.lnk Jump to behavior
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {5af95fd8-a22e-458f-acee-c61bd787178e}

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\reboot_launcher-9.2.7+9.2.7-windows-setup.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process information set: NOOPENFILEERRORBOX
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4396
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5460
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140jpn.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140ita.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140esn.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\system_theme_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140deu.dll Jump to dropped file
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Dropped PE file which has not been started: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497822.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-R06ER.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497812.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49782b.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfcm140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140chs.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140enu.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497825.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-32M2F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\local_notifier_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140fra.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497815.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\url_launcher_windows_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49781a.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\lawinserver.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-C996M.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\flutter_windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-ERBP0.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497824.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497814.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vcomp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\winrar.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140cht.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\app_links_plugin.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\reboot_launcher.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497823.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfcm140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140rus.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497813.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49782a.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140kor.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497826.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-F1D74.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-53Q8G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-QKH3T.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140u.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49780f.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\flutter_acrylic_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vcruntime140_threads.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497816.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497820.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\mfc140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-0OOE8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-GRMMD.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497829.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49782c.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497819.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497821.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\window_manager_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497811.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vcamp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\backend\is-53O6A.tmp Jump to dropped file
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\wixstdba.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497828.rbf (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 49782d.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\screen_retriever_plugin.dll (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497818.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-ETSC7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-588UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\is-K32K9.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497817.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\unins000.exe (copy) Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: 497827.rbf (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\is-AIOBF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\System32\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_isdecmp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\windows_taskbar_plugin.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Dropped PE file which has not been started: C:\Program Files\Reboot Launcher\data\flutter_assets\assets\build\7zip.exe (copy) Jump to dropped file
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Dropped PE file which has not been started: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\wixstdba.dll Jump to dropped file
Found evaded block containing many API calls
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evaded block: after key decision
Found evasive API chain (date check)
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Evasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Evasive API call chain: GetLocalTime,DecisionNodes
Found evasive API chain checking for process token information
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe API coverage: 9.8 %
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe API coverage: 9.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112 Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\SrTasks.exe TID: 7108 Thread sleep time: -290000s >= -30000s
Source: C:\Windows\System32\SrTasks.exe TID: 480 Thread sleep time: -300000s >= -30000s
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0040FE5Dh 11_2_0040FDC2
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0040FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0040FE56h 11_2_0040FDC2
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0074FE5Dh 12_2_0074FDC2
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0074FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0074FE56h 12_2_0074FDC2
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0027FE5Dh 13_2_0027FDC2
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0027FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0027FE56h 13_2_0027FDC2
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00AFFE5Dh 21_2_00AFFDC2
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AFFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00AFFE56h 21_2_00AFFDC2
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00FEFE5Dh 24_2_00FEFDC2
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FEFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00FEFE56h 24_2_00FEFDC2
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File Volume queried: C:\Windows FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 11_2_003D3BC3
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00414315 FindFirstFileW,FindClose, 11_2_00414315
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 11_2_003E993E
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00754315 FindFirstFileW,FindClose, 12_2_00754315
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0072993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 12_2_0072993E
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00713BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 12_2_00713BC3
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00284315 FindFirstFileW,FindClose, 13_2_00284315
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0025993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 13_2_0025993E
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00243BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 13_2_00243BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AC3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 21_2_00AC3BC3
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00B04315 FindFirstFileW,FindClose, 21_2_00B04315
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AD993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 21_2_00AD993E
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FF4315 FindFirstFileW,FindClose, 24_2_00FF4315
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FC993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose, 24_2_00FC993E
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FB3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose, 24_2_00FB3BC3
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_0041962D VirtualQuery,GetSystemInfo, 11_2_0041962D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\NULL
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL
Source: SrTasks.exe, 00000011.00000003.2232483606.000002B796E7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: VC_redist.x64.exe, 0000001A.00000003.2442960105.00000000008B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}O
Source: SrTasks.exe, 0000001F.00000002.2522749719.0000024632B61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: reboot_launcher-9.2.7+9.2.7-windows-setup.tmp, 00000001.00000003.2334107602.00000000009C6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SrTasks.exe, 0000001F.00000003.2520199927.0000024632AF7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:W
Source: SrTasks.exe, 00000011.00000003.2232483606.000002B796E7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:88
Source: SrTasks.exe, 00000011.00000003.2268365506.000002B796E8A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:AA
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process information queried: ProcessInformation
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_003FE625
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00404812 mov eax, dword ptr fs:[00000030h] 11_2_00404812
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00744812 mov eax, dword ptr fs:[00000030h] 12_2_00744812
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00274812 mov eax, dword ptr fs:[00000030h] 13_2_00274812
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF4812 mov eax, dword ptr fs:[00000030h] 21_2_00AF4812
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE4812 mov eax, dword ptr fs:[00000030h] 24_2_00FE4812
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D38D4 GetProcessHeap,RtlAllocateHeap, 11_2_003D38D4
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_003FE188
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_003FE625
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE773 SetUnhandledExceptionFilter, 11_2_003FE773
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00403BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_00403BB0
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_0073E188
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0073E625
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_0073E773 SetUnhandledExceptionFilter, 12_2_0073E773
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Code function: 12_2_00743BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00743BB0
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_0026E188
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0026E625
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_0026E773 SetUnhandledExceptionFilter, 13_2_0026E773
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Code function: 13_2_00273BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00273BB0
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEE188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 21_2_00AEE188
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_00AEE625
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AEE773 SetUnhandledExceptionFilter, 21_2_00AEE773
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Code function: 21_2_00AF3BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_2_00AF3BB0
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDE188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 24_2_00FDE188
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_00FDE625
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FDE773 SetUnhandledExceptionFilter, 24_2_00FDE773
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Code function: 24_2_00FE3BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 24_2_00FE3BB0

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
Bypasses PowerShell execution policy
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Reboot Launcher'"
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Process created: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Process created: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe "C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe" -burn.filehandle.attached=656 -burn.filehandle.self=664 /quiet
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Process created: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe "C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{31F03EA9-3FAC-45C1-A4D9-19C552C12E15} {D265F6B3-B186-4C52-AD19-91A4547F599C} 3128
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -burn.filehandle.attached=640 -burn.filehandle.self=652 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded BurnPipe.{E1A31121-9B34-49D8-988B-590D6F1D7B9A} {C9EFFF6D-CD36-475A-80A8-A7A6E7B9CD10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BC4D612D-97C1-4D64-B019-2A3ABED83EE2} {0FE451CC-9FDC-4D3A-86C0-92B00C85195E} 5292
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=540 /quiet /burn.log.append "C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20241006033734.log"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded burnpipe.{e1a31121-9b34-49d8-988b-590d6f1d7b9a} {c9efff6d-cd36-475a-80a8-a7a6e7b9cd10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.filehandle.attached=640 -burn.filehandle.self=652 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded burnpipe.{e1a31121-9b34-49d8-988b-590d6f1d7b9a} {c9efff6d-cd36-475a-80a8-a7a6e7b9cd10} 764
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "c:\programdata\package cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\vc_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=540 /quiet /burn.log.append "c:\users\user\appdata\local\temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded burnpipe.{e1a31121-9b34-49d8-988b-590d6f1d7b9a} {c9efff6d-cd36-475a-80a8-a7a6e7b9cd10} 764
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe "c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\vc_redist.x64.exe" -burn.filehandle.attached=640 -burn.filehandle.self=652 -uninstall -quiet -burn.related.upgrade -burn.ancestors={5af95fd8-a22e-458f-acee-c61bd787178e} -burn.filehandle.self=1120 -burn.embedded burnpipe.{e1a31121-9b34-49d8-988b-590d6f1d7b9a} {c9efff6d-cd36-475a-80a8-a7a6e7b9cd10} 764
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Process created: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe "c:\programdata\package cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\vc_redist.x64.exe" -burn.clean.room="c:\programdata\package cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\vc_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=540 /quiet /burn.log.append "c:\users\user\appdata\local\temp\dd_vcredist_amd64_20241006033734.log"
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_004115CB InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree, 11_2_004115CB
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\_isetup\_setup64.tmp Code function: 2_2_0000000140001000 GetNamedSecurityInfoW,AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,LocalFree,FreeSid,LocalFree,GetLastError, 2_2_0000000140001000
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE9A7 cpuid 11_2_003FE9A7
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-EIN55.tmp\reboot_launcher-9.2.7+9.2.7-windows-setup.tmp Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\Temp\{02D08273-6D12-4CCB-98AA-1303668FD364}\.cr\VC_redist.x64.exe Queries volume information: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.ba\logo.png VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Queries volume information: C:\Windows\Temp\{F4E70D75-2435-4A72-871B-D052E3588B58}\.ba\logo.png VolumeInformation
Source: C:\ProgramData\Package Cache\{5af95fd8-a22e-458f-acee-c61bd787178e}\VC_redist.x64.exe Queries volume information: C:\Users\user\AppData\Local\Temp\{E360B371-F25D-4756-83D0-5E84C1294988}\.ba\logo.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003E4CE8 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree, 11_2_003E4CE8
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003FE513 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 11_2_003FE513
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D60BA GetUserNameW,GetLastError, 11_2_003D60BA
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_00418733 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime, 11_2_00418733
Source: C:\Users\user\AppData\Local\Temp\is-TCHP5.tmp\VC_redist.x64.exe Code function: 11_2_003D508D GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize, 11_2_003D508D
Source: C:\Windows\Temp\{C3FB4052-7221-4530-8ADA-67D3AAAAE111}\.be\VC_redist.x64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1526553 Sample: reboot_launcher-9.2.7+9.2.7... Startdate: 06/10/2024 Architecture: WINDOWS Score: 34 95 Multi AV Scanner detection for submitted file 2->95 97 Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet 2->97 12 msiexec.exe 2->12         started        16 reboot_launcher-9.2.7+9.2.7-windows-setup.exe 2 2->16         started        18 VC_redist.x64.exe 2->18         started        20 2 other processes 2->20 process3 file4 79 C:\Windows\System32\vcruntime140_1.dll, PE32+ 12->79 dropped 81 C:\Windows\System32\vcruntime140.dll, PE32+ 12->81 dropped 83 C:\Windows\System32\vcomp140.dll, PE32+ 12->83 dropped 87 48 other files (22 malicious) 12->87 dropped 103 Infects executable files (exe, dll, sys, html) 12->103 85 reboot_launcher-9....7-windows-setup.tmp, PE32 16->85 dropped 22 reboot_launcher-9.2.7+9.2.7-windows-setup.tmp 706 16->22         started        26 VC_redist.x64.exe 18->26         started        28 conhost.exe 20->28         started        30 conhost.exe 20->30         started        signatures5 process6 file7 69 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 22->69 dropped 71 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 22->71 dropped 73 C:\Users\user\AppData\...\VC_redist.x64.exe, PE32 22->73 dropped 75 28 other files (none is malicious) 22->75 dropped 99 Bypasses PowerShell execution policy 22->99 101 Adds a directory exclusion to Windows Defender 22->101 32 powershell.exe 22->32         started        35 VC_redist.x64.exe 22->35         started        38 _setup64.tmp 22->38         started        40 VC_redist.x64.exe 26->40         started        signatures8 process9 file10 93 Loading BitLocker PowerShell Module 32->93 42 conhost.exe 32->42         started        44 WmiPrvSE.exe 32->44         started        63 C:\Windows\Temp\...\VC_redist.x64.exe, PE32 35->63 dropped 46 VC_redist.x64.exe 35->46         started        49 conhost.exe 38->49         started        65 C:\Users\user\AppData\Local\...\wixstdba.dll, PE32 40->65 dropped 51 VC_redist.x64.exe 40->51         started        signatures11 process12 file13 89 C:\Windows\Temp\...\VC_redist.x64.exe, PE32 46->89 dropped 91 C:\Windows\Temp\...\wixstdba.dll, PE32 46->91 dropped 53 VC_redist.x64.exe 46->53         started        process14 file15 67 C:\ProgramData\...\VC_redist.x64.exe, PE32 53->67 dropped 56 VC_redist.x64.exe 53->56         started        process16 process17 58 VC_redist.x64.exe 56->58         started        file18 77 C:\Windows\Temp\...\wixstdba.dll, PE32 58->77 dropped 61 VC_redist.x64.exe 58->61         started        process19
⊘No contacted IP infos