Overview

overview

8

Static

static

5

StartAllBa...st.exe

windows10-2004-x64

5

StartAllBa...st.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    StartAllBackforWin11-ATLv2.0byGhost.exe
  • Size 631KB
  • Sample260620-v56beshv3x
  • SHA256 5504d3aa7edd1e305c055ceb0908c28fa0b9f2b02d546615d9974e561c1af568
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywareupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 15 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBackforWin11-ATLv2.0byGhost.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBackforWin11-ATLv2.0byGhost.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Users\Admin\AppData\Local\Temp\Ghost\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Ghost\Setup.exe" /elevated /silent
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\StartAllBackCfg.exe
        "C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\StartAllBackCfg.exe" /install /elevated /silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "\StartIsBack health check" /F
          4⤵
            PID:5240
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2656
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM sndvol.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4832
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM shellhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:108
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM prevhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5684
          • C:\Windows\SYSTEM32\tskill.exe
            tskill.exe explorer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5732
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5444
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks.exe /Create /TN "\StartAllBack Update" /XML "C:\Users\Admin\AppData\Local\Temp\sabtask.xml"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:932
      • C:\Program Files\StartAllBack\Patch.exe
        "C:\Program Files\StartAllBack\Patch.exe" /silent /overwrite
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2664
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Program Files\StartAllBack\kill.cmd"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:788
          • C:\Windows\system32\taskkill.exe
            TASKKILL /IM explorer.exe /f
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2992
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Program Files\StartAllBack\start.cmd"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6104
          • C:\Windows\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Loads dropped DLL
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:6096
            • C:\Program Files\StartAllBack\UpdateCheck.exe
              "C:\Program Files\StartAllBack\UpdateCheck.exe" reset
              5⤵
              • Executes dropped EXE
              • System policy modification
              PID:3136
            • C:\Program Files\StartAllBack\StartAllBackCfg.exe
              "C:\Program Files\StartAllBack\StartAllBackCfg.exe" /welcome
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2088
    • C:\Windows\System32\ShellHost.exe
      "C:\Windows\System32\ShellHost.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3432
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5604
        • C:\Program Files\StartAllBack\UpdateCheck.exe
          "C:\Program Files\StartAllBack\UpdateCheck.exe" reset
          3⤵
          • Executes dropped EXE
          • System policy modification
          PID:4932
      • C:\Windows\System32\ShellHost.exe
        "C:\Windows\System32\ShellHost.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:5732

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Patch.exe
          • Path C:\Program Files\StartAllBack\Patch.exe
          • Size 63KB
          • SHA256 124a96831880a7f4ec1c70705466b9a48723ca387f7abc12f0d28d28a18edf20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kill.cmd
          • Path C:\Program Files\StartAllBack\kill.cmd
          • Size 28B
          • SHA256 f56d48597370f2b4417cab335f95485f065315375f41931fff5d782f3ac103d9
          • MD5 SHA1 SHA512
          Submit Download

          Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Ghost\Setup.exe
          • Size 2.0MB
          • SHA256 b3318d07003b6dca3ab0746340f91678f496fb37e8613eba75f2800b76418c27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicLoaderX64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\DarkMagicLoaderX64.exe
          • Size 13KB
          • SHA256 da71702f576e2eec2934fef21e0b32b45486344c344eebcc70d959a3b032a77e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicLoaderX86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\DarkMagicLoaderX86.exe
          • Size 13KB
          • SHA256 dd29cf7f233f4066337c5f0e703b7bcac72a50038e5fc7cfc6a4e39d3cdcbc14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\DarkMagicX64.dll
          • Size 183KB
          • SHA256 785fb68ec66279cb4a48911d0334fccb4a807f157273597b54af41f9e9536625
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\DarkMagicX86.dll
          • Size 152KB
          • SHA256 920308d37f422d67c5ce40dba54a9305a58801172839aa7d49408c2f703293a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.orb
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Orbs\Windows 7.orb
          • Size 295KB
          • SHA256 e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clover.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Orbs\clover.svg
          • Size 1KB
          • SHA256 1e0e1ea6149fffe9a6d09a77b404fe17db7d455d1036faebdc168b1ce5869282
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e1evenorb-pr.png
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Orbs\e1evenorb-pr.png
          • Size 167KB
          • SHA256 6e451fe2d887698c4290b830aec1a4a196de22eb3bcf6734b567521bf2d6edf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          w8logo.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Orbs\w8logo.svg
          • Size 713B
          • SHA256 c75684410793a98a051a1cf95395709c73e9589037d47be3f6277b4ac355b7fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 f51c5b5b68f6bc5104188a93f145ca2d6e57d94636fda34e41599bae0e5ec682
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.Computer.Manage.svg
          • Size 4KB
          • SHA256 11b72939689a479cbda2bf96a64774d2ac605c7054cf23deba0663ed4dc11d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 0d4efb27e6c7b774206155dd6abddd2cc85635a467c869c7675da196869a5e2b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.MoveToMenu.svg
          • Size 858B
          • SHA256 40f70db8f7814acf922e25411f82f9d9b9420d30e34f5c6199b8488e260ca13f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 e642c6fa1611e1e937a31bce4b61d1951d6783e3ff633729f86096b67cfe6228
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 8e4de3dfc33b3b3edc2d3b37e95669c9794d98cefefdc50bb6ba02f0937d606c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 2b9a7c378e0160ac8e5843f1ced91021802b677776dcf9ffa71524adbefa1800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 ebfceadfeac8434c464713ec411e1b9059a743ef0e7b676adaba78b005bb877e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\accessmedia.svg
          • Size 634B
          • SHA256 a14b44b414971fae445df013a5de357ff625e4a509bfead3b0c01a74844aa515
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\easyaccess.svg
          • Size 2KB
          • SHA256 6cebc92632e26a4fea23d3e95e3590912f0037f2500ebe576e6d0af54abd4c79
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.SystemProperties.svg
          • Size 3KB
          • SHA256 e99475d76b50f34ec3b1e4346677237d6737fa78bb572b9b7c7fb6837d8a0662
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.folderoptions.svg
          • Size 1019B
          • SHA256 3615ad11593e0fa41c9fcebe32b9e96865cf13a27640f87802aa3c33730a05eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.help.svg
          • Size 3KB
          • SHA256 2aed30dcca71f8d120cffc6b01c318bf1898e62615045fea5e33e1552f289e93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.layout.svg
          • Size 680B
          • SHA256 f39d73c1cd814615aa74ce9fc04a4b7f4c83156b2173875134eaa3f60fb70c7e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.open.svg
          • Size 2KB
          • SHA256 412a37d3e1856910f22c2c35071eae274e3d83047e7a33339f31f501cc5579b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.opencontrolpanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.opencontrolpanel.svg
          • Size 1KB
          • SHA256 bd0c11262c33d08d2f3030d256ae7c16fad62d0050dfc568e9057871db3b5b5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.pastelink.svg
          • Size 726B
          • SHA256 2e6c18304704c1ae4885abfe8b002c429a4ca7676f0a0cf8e168950d63f7a218
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.removeproperties.svg
          • Size 1KB
          • SHA256 a6a11b85c515027090396db56e7f41036861f3fc00f518e23885566d629b44b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.slideshow.svg
          • Size 4KB
          • SHA256 d384130da33fa213933956306d7ee8bb8377f8dfd3bc4aee588fb453d2b34fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-dark\windows.troubleshoot.svg
          • Size 617B
          • SHA256 f720372e65c2882f142712338aaeded555129dd4853dd2ccd432613d74707616
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 c118dfe2cca3abbe108b9ca2c664305f79e7b348cb142f504e826d04381bf143
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.Computer.Manage.svg
          • Size 5KB
          • SHA256 24ab22832e298877665641631c70ded68e5f9fc750d5e15f59b65cce06d8b4b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 9d81e9391ee6e6515a573dce662d0d50d4938f81ff640051873667c93c6ac469
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.MoveToMenu.svg
          • Size 1020B
          • SHA256 bf8458615d4d28a96091627aafc0cf6853aaaf93e87bda52e3edc62baff9c5f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 118e3fd996a8eaa8406d0e98fb76e8224b23e32210543993c71da993e07c368f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 48ee93c6978fb0bf08e2de11ffccb52e190d9325f7889c9c21442b97167fef1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 1fb69fbf893a9c105ef34a722e7bf2bf52cd152f1f5c16d10a5551f9cc3bcfae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 c3537a0c281a6332ac2a7eb35285b3bc7ec9bda291442d482b98a45b01eed7c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\accessmedia.svg
          • Size 868B
          • SHA256 dc2ab9af2b1cd24b11acd4f0ca0e55cbb65d2eac5228a411c2698d0827ffad7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\easyaccess.svg
          • Size 2KB
          • SHA256 3a58ece9da8a88a997fb95b0ed8d81f223218f2e089192b451df8a451fcc9800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.SystemProperties.svg
          • Size 4KB
          • SHA256 1808bf21c47237f8bb8cde2d014d79281cc41ab8bbffefd929b4d64fdecc2204
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.edit.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.edit.svg
          • Size 1KB
          • SHA256 1e69d480542ecf89010e0947c100605423ec60a92bd87702c72513952065b3b8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.email.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.email.svg
          • Size 853B
          • SHA256 3568a00a810d5984b8c71df89157bed7a34466ae72ac743e2020e8c29fe3df57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.folderoptions.svg
          • Size 1KB
          • SHA256 1b0fbca9b1dad3bd78494ef75632d54f977e22c6835788d00e179af2bc23bafd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.help.svg
          • Size 3KB
          • SHA256 5cff4abe766fa2c18a0e69d5be21388ddbd90e47ff7316090ba2279ccdf19b6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.layout.svg
          • Size 799B
          • SHA256 9b2c371947eec1f36cf20096e33a32aec971a1148646451863aee8a868df6dab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.open.svg
          • Size 3KB
          • SHA256 644d576f3f86307b5f9448b88dce9f53e4fd40e14fd00317c37efc70f8a6c3b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.openControlPanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.openControlPanel.svg
          • Size 2KB
          • SHA256 942cf1dbbc4b72975e512dca10160d0e0c14bbab067b3a2c50bf9d33b8e22fd1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.pastelink.svg
          • Size 856B
          • SHA256 7508b21509f19d080ca825c15d3ef4314dc35920f8aff7ffe4ea896f3e384872
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.removeproperties.svg
          • Size 2KB
          • SHA256 7f7424bc7c1580d0c6fa842fc0c08ad9a4aad1f2100bd314170a81f242a13e2d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.slideshow.svg
          • Size 5KB
          • SHA256 b24b24932cc2156d51f7ee5365656f83b358d894860ba921eb353f1664dc22fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Ribbon\theme-light\windows.troubleshoot.svg
          • Size 736B
          • SHA256 d019f486cc06d5083dda9ac166d538357471ba4076ff0a332ad5a9c048947513
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartAllBackCfg.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\StartAllBackCfg.exe
          • Size 3.4MB
          • SHA256 1495cbe09f3b30df672669727267fc4c88d5c4d0adaa4ee357ebe2cd0a916758
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackLoaderX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\StartAllBackLoaderX64.dll
          • Size 14KB
          • SHA256 18f1f58c51e98b064602fcb3a66725b6bc01cbe0ce2d1ae1fb43e1c28e8332af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\StartAllBackX64.dll
          • Size 1.0MB
          • SHA256 f21c5d7c6d9182bd0db5007b52b975fc6b24903bd5952d882ea7c3fc9d8c8d5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Plain8.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Styles\Plain8.msstyles
          • Size 118KB
          • SHA256 43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\Styles\Windows 7.msstyles
          • Size 385KB
          • SHA256 272d62fa07772fe8c72766a64c923d54f6d92260bbe9a654997d7ef9e21c7b25
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateCheck.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.91E12068\UpdateCheck.exe
          • Size 49KB
          • SHA256 9af2087d3d00cb76c7825d7dd0eed7d913373b7a27cf38638862f9b4b55fab5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dup2patcher.dll
          • Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
          • Size 57KB
          • SHA256 62dca27bfcf3cfab9fe834ca78278be7a53d8c1b485c0fa5051a86703fe79059
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sabtask.xml
          • Path C:\Users\Admin\AppData\Local\Temp\sabtask.xml
          • Size 2KB
          • SHA256 cab61ef9bd58338d1cc4815c0f4725985b41196032c66b5a4d0a92d3bc5f1a6c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2088-179-0x0000000000400000-0x0000000000760000-memory.dmp
          Download

          memory/2088-182-0x0000000000400000-0x0000000000760000-memory.dmp
          Download

          memory/2396-151-0x0000000000400000-0x0000000000760000-memory.dmp
          Download

          memory/2664-162-0x00000000734B0000-0x00000000734D7000-memory.dmp
          Download

          memory/3344-21-0x00000000002E0000-0x0000000000447000-memory.dmp
          Download

          memory/3344-177-0x00000000002E0000-0x0000000000447000-memory.dmp
          Download

          memory/3344-178-0x00000000002E0000-0x0000000000447000-memory.dmp
          Download

          memory/3344-20-0x00000000002E0000-0x0000000000447000-memory.dmp
          Download

          memory/3344-0-0x00000000002E0000-0x0000000000447000-memory.dmp
          Download