Overview

overview

6

Static

static

1

StartAllBa...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    123s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 12:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    StartAllBack_3.9.26_setup.exe
  • Size 2.0MB
  • Sample260922-pkgjnsvgqe
  • SHA256 8036b1d2d369121a80ab20f5924d9d5d3e7c0b26aef22529c0f6296b8d836e9a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 61 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.26_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.26_setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackCfg.exe
      "C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackCfg.exe" /install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackCfg.exe
        "C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackCfg.exe" /install /elevated /silent
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "\StartIsBack health check" /F
          4⤵
            PID:1976
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4712
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM sndvol.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2728
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM shellhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3116
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM prevhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4528
          • C:\Windows\SYSTEM32\tskill.exe
            tskill.exe explorer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3396
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3488
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks.exe /Create /TN "\StartAllBack Update" /XML "C:\Users\Admin\AppData\Local\Temp\sabtask.xml"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2748
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5632
          • C:\Program Files\StartAllBack\UpdateCheck.exe
            "C:\Program Files\StartAllBack\UpdateCheck.exe" reset
            4⤵
            • Executes dropped EXE
            • System policy modification
            PID:3120
          • C:\Program Files\StartAllBack\StartAllBackCfg.exe
            "C:\Program Files\StartAllBack\StartAllBackCfg.exe" /welcome
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Modifies Control Panel
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3224
    • C:\Windows\System32\ShellHost.exe
      "C:\Windows\System32\ShellHost.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2032
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:5808

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            DarkMagicLoaderX64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\DarkMagicLoaderX64.exe
            • Size 13KB
            • SHA256 54765d243c5b074a5b9439ced9f7f8470aeb8c9efaffe524008233c9434424e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DarkMagicLoaderX86.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\DarkMagicLoaderX86.exe
            • Size 13KB
            • SHA256 4aa53e81db9cdef46bc581889b546a8c7e47fbac2957d9efcc6b1290eefa6824
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DarkMagicX64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\DarkMagicX64.dll
            • Size 186KB
            • SHA256 f78555393169d268aba792d91dde5abf266039e30eddcf76a9ba15b22df5d6c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DarkMagicX86.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\DarkMagicX86.dll
            • Size 155KB
            • SHA256 4728a354b82f7371cc88444fb29c1908d32623e5a0d614bcda8e8abc284a1358
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows 7.orb
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Orbs\Windows 7.orb
            • Size 295KB
            • SHA256 e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clover.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Orbs\clover.svg
            • Size 1KB
            • SHA256 1e0e1ea6149fffe9a6d09a77b404fe17db7d455d1036faebdc168b1ce5869282
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e1evenorb-pr.png
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Orbs\e1evenorb-pr.png
            • Size 167KB
            • SHA256 6e451fe2d887698c4290b830aec1a4a196de22eb3bcf6734b567521bf2d6edf2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            w8logo.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Orbs\w8logo.svg
            • Size 713B
            • SHA256 c75684410793a98a051a1cf95395709c73e9589037d47be3f6277b4ac355b7fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.AddRemovePrograms.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.AddRemovePrograms.svg
            • Size 3KB
            • SHA256 f51c5b5b68f6bc5104188a93f145ca2d6e57d94636fda34e41599bae0e5ec682
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.Computer.Manage.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.Computer.Manage.svg
            • Size 4KB
            • SHA256 11b72939689a479cbda2bf96a64774d2ac605c7054cf23deba0663ed4dc11d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows.CopyToMenu.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.CopyToMenu.svg
            • Size 2KB
            • SHA256 0d4efb27e6c7b774206155dd6abddd2cc85635a467c869c7675da196869a5e2b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.MoveToMenu.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.MoveToMenu.svg
            • Size 858B
            • SHA256 40f70db8f7814acf922e25411f82f9d9b9420d30e34f5c6199b8488e260ca13f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.MultiVerb.cmd.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.MultiVerb.cmd.svg
            • Size 4KB
            • SHA256 e642c6fa1611e1e937a31bce4b61d1951d6783e3ff633729f86096b67cfe6228
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows.MultiVerb.cmdPromptAsAdministrator.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.MultiVerb.cmdPromptAsAdministrator.svg
            • Size 2KB
            • SHA256 8e4de3dfc33b3b3edc2d3b37e95669c9794d98cefefdc50bb6ba02f0937d606c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.RibbonPermissionsDialog.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.RibbonPermissionsDialog.svg
            • Size 2KB
            • SHA256 2b9a7c378e0160ac8e5843f1ced91021802b677776dcf9ffa71524adbefa1800
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.shareprivate.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\Windows.shareprivate.svg
            • Size 3KB
            • SHA256 ebfceadfeac8434c464713ec411e1b9059a743ef0e7b676adaba78b005bb877e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            accessmedia.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\accessmedia.svg
            • Size 634B
            • SHA256 a14b44b414971fae445df013a5de357ff625e4a509bfead3b0c01a74844aa515
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            easyaccess.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\easyaccess.svg
            • Size 2KB
            • SHA256 6cebc92632e26a4fea23d3e95e3590912f0037f2500ebe576e6d0af54abd4c79
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.SystemProperties.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.SystemProperties.svg
            • Size 3KB
            • SHA256 e99475d76b50f34ec3b1e4346677237d6737fa78bb572b9b7c7fb6837d8a0662
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.folderoptions.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.folderoptions.svg
            • Size 1019B
            • SHA256 3615ad11593e0fa41c9fcebe32b9e96865cf13a27640f87802aa3c33730a05eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.help.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.help.svg
            • Size 3KB
            • SHA256 2aed30dcca71f8d120cffc6b01c318bf1898e62615045fea5e33e1552f289e93
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.layout.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.layout.svg
            • Size 680B
            • SHA256 f39d73c1cd814615aa74ce9fc04a4b7f4c83156b2173875134eaa3f60fb70c7e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.open.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.open.svg
            • Size 2KB
            • SHA256 412a37d3e1856910f22c2c35071eae274e3d83047e7a33339f31f501cc5579b2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.opencontrolpanel.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.opencontrolpanel.svg
            • Size 1KB
            • SHA256 bd0c11262c33d08d2f3030d256ae7c16fad62d0050dfc568e9057871db3b5b5a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.pastelink.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.pastelink.svg
            • Size 726B
            • SHA256 2e6c18304704c1ae4885abfe8b002c429a4ca7676f0a0cf8e168950d63f7a218
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.removeproperties.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.removeproperties.svg
            • Size 1KB
            • SHA256 a6a11b85c515027090396db56e7f41036861f3fc00f518e23885566d629b44b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.slideshow.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.slideshow.svg
            • Size 4KB
            • SHA256 d384130da33fa213933956306d7ee8bb8377f8dfd3bc4aee588fb453d2b34fd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windows.troubleshoot.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-dark\windows.troubleshoot.svg
            • Size 617B
            • SHA256 f720372e65c2882f142712338aaeded555129dd4853dd2ccd432613d74707616
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.AddRemovePrograms.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.AddRemovePrograms.svg
            • Size 3KB
            • SHA256 c118dfe2cca3abbe108b9ca2c664305f79e7b348cb142f504e826d04381bf143
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.Computer.Manage.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.Computer.Manage.svg
            • Size 5KB
            • SHA256 24ab22832e298877665641631c70ded68e5f9fc750d5e15f59b65cce06d8b4b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows.CopyToMenu.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.CopyToMenu.svg
            • Size 2KB
            • SHA256 9d81e9391ee6e6515a573dce662d0d50d4938f81ff640051873667c93c6ac469
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.MoveToMenu.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.MoveToMenu.svg
            • Size 1020B
            • SHA256 bf8458615d4d28a96091627aafc0cf6853aaaf93e87bda52e3edc62baff9c5f9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.MultiVerb.cmd.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.MultiVerb.cmd.svg
            • Size 4KB
            • SHA256 118e3fd996a8eaa8406d0e98fb76e8224b23e32210543993c71da993e07c368f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows.MultiVerb.cmdPromptAsAdministrator.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.MultiVerb.cmdPromptAsAdministrator.svg
            • Size 2KB
            • SHA256 48ee93c6978fb0bf08e2de11ffccb52e190d9325f7889c9c21442b97167fef1e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.RibbonPermissionsDialog.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.RibbonPermissionsDialog.svg
            • Size 2KB
            • SHA256 1fb69fbf893a9c105ef34a722e7bf2bf52cd152f1f5c16d10a5551f9cc3bcfae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Windows.shareprivate.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\Windows.shareprivate.svg
            • Size 3KB
            • SHA256 c3537a0c281a6332ac2a7eb35285b3bc7ec9bda291442d482b98a45b01eed7c7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            accessmedia.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\accessmedia.svg
            • Size 868B
            • SHA256 dc2ab9af2b1cd24b11acd4f0ca0e55cbb65d2eac5228a411c2698d0827ffad7c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            easyaccess.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\easyaccess.svg
            • Size 2KB
            • SHA256 3a58ece9da8a88a997fb95b0ed8d81f223218f2e089192b451df8a451fcc9800
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.SystemProperties.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.SystemProperties.svg
            • Size 4KB
            • SHA256 1808bf21c47237f8bb8cde2d014d79281cc41ab8bbffefd929b4d64fdecc2204
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windows.edit.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.edit.svg
            • Size 1KB
            • SHA256 1e69d480542ecf89010e0947c100605423ec60a92bd87702c72513952065b3b8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.email.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.email.svg
            • Size 853B
            • SHA256 3568a00a810d5984b8c71df89157bed7a34466ae72ac743e2020e8c29fe3df57
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.folderoptions.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.folderoptions.svg
            • Size 1KB
            • SHA256 1b0fbca9b1dad3bd78494ef75632d54f977e22c6835788d00e179af2bc23bafd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.help.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.help.svg
            • Size 3KB
            • SHA256 5cff4abe766fa2c18a0e69d5be21388ddbd90e47ff7316090ba2279ccdf19b6f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.layout.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.layout.svg
            • Size 799B
            • SHA256 9b2c371947eec1f36cf20096e33a32aec971a1148646451863aee8a868df6dab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.open.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.open.svg
            • Size 3KB
            • SHA256 644d576f3f86307b5f9448b88dce9f53e4fd40e14fd00317c37efc70f8a6c3b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.openControlPanel.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.openControlPanel.svg
            • Size 2KB
            • SHA256 942cf1dbbc4b72975e512dca10160d0e0c14bbab067b3a2c50bf9d33b8e22fd1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.pastelink.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.pastelink.svg
            • Size 856B
            • SHA256 7508b21509f19d080ca825c15d3ef4314dc35920f8aff7ffe4ea896f3e384872
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.removeproperties.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.removeproperties.svg
            • Size 2KB
            • SHA256 7f7424bc7c1580d0c6fa842fc0c08ad9a4aad1f2100bd314170a81f242a13e2d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            windows.slideshow.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.slideshow.svg
            • Size 5KB
            • SHA256 b24b24932cc2156d51f7ee5365656f83b358d894860ba921eb353f1664dc22fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windows.troubleshoot.svg
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Ribbon\theme-light\windows.troubleshoot.svg
            • Size 736B
            • SHA256 d019f486cc06d5083dda9ac166d538357471ba4076ff0a332ad5a9c048947513
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartAllBackCfg.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackCfg.exe
            • Size 3.4MB
            • SHA256 bee640d7b25519c7a1848c26b7de6aaea3260203246daf19a202e4d3f3adf4fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartAllBackLoaderX64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackLoaderX64.dll
            • Size 14KB
            • SHA256 ec5a6afeb8bb796c8ba1bfe60967f0db02200512fc02674fc8f728246ed03518
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartAllBackX64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\StartAllBackX64.dll
            • Size 1.0MB
            • SHA256 71aad4c83de3b7f24063ac486c176470929343cfa034d20636441ce86626f690
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Plain8.msstyles
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Styles\Plain8.msstyles
            • Size 118KB
            • SHA256 43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Windows 7.msstyles
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\Styles\Windows 7.msstyles
            • Size 385KB
            • SHA256 272d62fa07772fe8c72766a64c923d54f6d92260bbe9a654997d7ef9e21c7b25
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateCheck.exe
            • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.95B9F3C8\UpdateCheck.exe
            • Size 49KB
            • SHA256 f16f557407ff6fbaedbc2bb9d47ca6cab05e6a905134069757414dc5b3ca52f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sabtask.xml
            • Path C:\Users\Admin\AppData\Local\Temp\sabtask.xml
            • Size 2KB
            • SHA256 cab61ef9bd58338d1cc4815c0f4725985b41196032c66b5a4d0a92d3bc5f1a6c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1136-126-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/1136-62-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
            Download

            memory/1724-124-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/1724-125-0x00000000036E0000-0x000000000378E000-memory.dmp
            Download

            memory/3224-148-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-134-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-136-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-138-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-140-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-142-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-150-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-152-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-154-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/3224-156-0x0000000000400000-0x0000000000760000-memory.dmp
            Download

            memory/5632-133-0x0000000004C90000-0x0000000004C9D000-memory.dmp
            Download