Overview

overview

6

Static

static

1

StartAllBa...up.exe

windows10-2004-x64

5

StartAllBa...up.exe

windows11-ltsc_2024-x64

6

Resubmissions

27/10/2026, 22:34

261027-2g5tbavy5q6

27/10/2026, 22:27

261027-2datrsxsfv6

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 22:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    StartAllBack_3.9.28_setup.exe
  • Size 2.0MB
  • Sample261027-2datrsxsfv
  • SHA256 a760f333f6e3305e7f0e4a09982da129d01003752aa2260513a583f5e5be7b29
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 61 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.28_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.9.28_setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackCfg.exe
      "C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackCfg.exe" /install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5476
      • C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackCfg.exe
        "C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackCfg.exe" /install /elevated /silent
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "\StartIsBack health check" /F
          4⤵
            PID:2876
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4800
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM sndvol.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:480
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM shellhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5096
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM prevhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:800
          • C:\Windows\SYSTEM32\tskill.exe
            tskill.exe explorer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3144
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4756
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks.exe /Create /TN "\StartAllBack Update" /XML "C:\Users\Admin\AppData\Local\Temp\sabtask.xml"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4068
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Program Files\StartAllBack\UpdateCheck.exe
            "C:\Program Files\StartAllBack\UpdateCheck.exe" reset
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System policy modification
            PID:5816
          • C:\Program Files\StartAllBack\StartAllBackCfg.exe
            "C:\Program Files\StartAllBack\StartAllBackCfg.exe" /welcome
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Modifies Control Panel
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4696
    • C:\Windows\System32\ShellHost.exe
      "C:\Windows\System32\ShellHost.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1112

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          3
          T1082

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DarkMagicLoaderX64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\DarkMagicLoaderX64.exe
          • Size 13KB
          • SHA256 b09befd5e090a498aff088ef6bd9b3c61e28ca16bc83bc2024a28a16f292e754
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicLoaderX86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\DarkMagicLoaderX86.exe
          • Size 13KB
          • SHA256 c47a8575e5b1310f12ea4d92a10f9e78c77960050f9ade876161c923e76e5913
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\DarkMagicX64.dll
          • Size 188KB
          • SHA256 61895c311e7461213849080bbc9549fedd69a4de18669c38ef17c316e9d398ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\DarkMagicX86.dll
          • Size 156KB
          • SHA256 24789bdf41c6f5e05c831f5909c85ff102b7303542f939660c743f923a667e14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.orb
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Orbs\Windows 7.orb
          • Size 295KB
          • SHA256 e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clover.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Orbs\clover.svg
          • Size 1KB
          • SHA256 1e0e1ea6149fffe9a6d09a77b404fe17db7d455d1036faebdc168b1ce5869282
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e1evenorb-pr.png
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Orbs\e1evenorb-pr.png
          • Size 167KB
          • SHA256 6e451fe2d887698c4290b830aec1a4a196de22eb3bcf6734b567521bf2d6edf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          w8logo.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Orbs\w8logo.svg
          • Size 713B
          • SHA256 c75684410793a98a051a1cf95395709c73e9589037d47be3f6277b4ac355b7fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 f51c5b5b68f6bc5104188a93f145ca2d6e57d94636fda34e41599bae0e5ec682
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.Computer.Manage.svg
          • Size 4KB
          • SHA256 11b72939689a479cbda2bf96a64774d2ac605c7054cf23deba0663ed4dc11d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 0d4efb27e6c7b774206155dd6abddd2cc85635a467c869c7675da196869a5e2b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.MoveToMenu.svg
          • Size 858B
          • SHA256 40f70db8f7814acf922e25411f82f9d9b9420d30e34f5c6199b8488e260ca13f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 e642c6fa1611e1e937a31bce4b61d1951d6783e3ff633729f86096b67cfe6228
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 8e4de3dfc33b3b3edc2d3b37e95669c9794d98cefefdc50bb6ba02f0937d606c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 2b9a7c378e0160ac8e5843f1ced91021802b677776dcf9ffa71524adbefa1800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 ebfceadfeac8434c464713ec411e1b9059a743ef0e7b676adaba78b005bb877e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\accessmedia.svg
          • Size 634B
          • SHA256 a14b44b414971fae445df013a5de357ff625e4a509bfead3b0c01a74844aa515
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\easyaccess.svg
          • Size 2KB
          • SHA256 6cebc92632e26a4fea23d3e95e3590912f0037f2500ebe576e6d0af54abd4c79
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.SystemProperties.svg
          • Size 3KB
          • SHA256 e99475d76b50f34ec3b1e4346677237d6737fa78bb572b9b7c7fb6837d8a0662
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.folderoptions.svg
          • Size 1019B
          • SHA256 3615ad11593e0fa41c9fcebe32b9e96865cf13a27640f87802aa3c33730a05eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.help.svg
          • Size 3KB
          • SHA256 2aed30dcca71f8d120cffc6b01c318bf1898e62615045fea5e33e1552f289e93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.layout.svg
          • Size 680B
          • SHA256 f39d73c1cd814615aa74ce9fc04a4b7f4c83156b2173875134eaa3f60fb70c7e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.open.svg
          • Size 2KB
          • SHA256 412a37d3e1856910f22c2c35071eae274e3d83047e7a33339f31f501cc5579b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.opencontrolpanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.opencontrolpanel.svg
          • Size 1KB
          • SHA256 bd0c11262c33d08d2f3030d256ae7c16fad62d0050dfc568e9057871db3b5b5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.pastelink.svg
          • Size 726B
          • SHA256 2e6c18304704c1ae4885abfe8b002c429a4ca7676f0a0cf8e168950d63f7a218
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.removeproperties.svg
          • Size 1KB
          • SHA256 a6a11b85c515027090396db56e7f41036861f3fc00f518e23885566d629b44b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.slideshow.svg
          • Size 4KB
          • SHA256 d384130da33fa213933956306d7ee8bb8377f8dfd3bc4aee588fb453d2b34fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-dark\windows.troubleshoot.svg
          • Size 617B
          • SHA256 f720372e65c2882f142712338aaeded555129dd4853dd2ccd432613d74707616
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 c118dfe2cca3abbe108b9ca2c664305f79e7b348cb142f504e826d04381bf143
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.Computer.Manage.svg
          • Size 5KB
          • SHA256 24ab22832e298877665641631c70ded68e5f9fc750d5e15f59b65cce06d8b4b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 9d81e9391ee6e6515a573dce662d0d50d4938f81ff640051873667c93c6ac469
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.MoveToMenu.svg
          • Size 1020B
          • SHA256 bf8458615d4d28a96091627aafc0cf6853aaaf93e87bda52e3edc62baff9c5f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 118e3fd996a8eaa8406d0e98fb76e8224b23e32210543993c71da993e07c368f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 48ee93c6978fb0bf08e2de11ffccb52e190d9325f7889c9c21442b97167fef1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 1fb69fbf893a9c105ef34a722e7bf2bf52cd152f1f5c16d10a5551f9cc3bcfae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 c3537a0c281a6332ac2a7eb35285b3bc7ec9bda291442d482b98a45b01eed7c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\accessmedia.svg
          • Size 868B
          • SHA256 dc2ab9af2b1cd24b11acd4f0ca0e55cbb65d2eac5228a411c2698d0827ffad7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\easyaccess.svg
          • Size 2KB
          • SHA256 3a58ece9da8a88a997fb95b0ed8d81f223218f2e089192b451df8a451fcc9800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.SystemProperties.svg
          • Size 4KB
          • SHA256 1808bf21c47237f8bb8cde2d014d79281cc41ab8bbffefd929b4d64fdecc2204
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.edit.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.edit.svg
          • Size 1KB
          • SHA256 1e69d480542ecf89010e0947c100605423ec60a92bd87702c72513952065b3b8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.email.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.email.svg
          • Size 853B
          • SHA256 3568a00a810d5984b8c71df89157bed7a34466ae72ac743e2020e8c29fe3df57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.folderoptions.svg
          • Size 1KB
          • SHA256 1b0fbca9b1dad3bd78494ef75632d54f977e22c6835788d00e179af2bc23bafd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.help.svg
          • Size 3KB
          • SHA256 5cff4abe766fa2c18a0e69d5be21388ddbd90e47ff7316090ba2279ccdf19b6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.layout.svg
          • Size 799B
          • SHA256 9b2c371947eec1f36cf20096e33a32aec971a1148646451863aee8a868df6dab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.open.svg
          • Size 3KB
          • SHA256 644d576f3f86307b5f9448b88dce9f53e4fd40e14fd00317c37efc70f8a6c3b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.openControlPanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.openControlPanel.svg
          • Size 2KB
          • SHA256 942cf1dbbc4b72975e512dca10160d0e0c14bbab067b3a2c50bf9d33b8e22fd1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.pastelink.svg
          • Size 856B
          • SHA256 7508b21509f19d080ca825c15d3ef4314dc35920f8aff7ffe4ea896f3e384872
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.removeproperties.svg
          • Size 2KB
          • SHA256 7f7424bc7c1580d0c6fa842fc0c08ad9a4aad1f2100bd314170a81f242a13e2d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.slideshow.svg
          • Size 5KB
          • SHA256 b24b24932cc2156d51f7ee5365656f83b358d894860ba921eb353f1664dc22fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Ribbon\theme-light\windows.troubleshoot.svg
          • Size 736B
          • SHA256 d019f486cc06d5083dda9ac166d538357471ba4076ff0a332ad5a9c048947513
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartAllBackCfg.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackCfg.exe
          • Size 3.4MB
          • SHA256 a3a991e6d2e3da056eb4dbfcb5c560f78ae8511e4c44835ea03003f29cc64eca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackLoaderX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackLoaderX64.dll
          • Size 14KB
          • SHA256 64a5ca4db0633ddd72758ac7624c06ebe522bc42f033c1cb48037e4b6a4bd245
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\StartAllBackX64.dll
          • Size 1.0MB
          • SHA256 8c26c72247204d98c2ae3a092bfbe964430d387ea56663f3760ef118f214e1b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Plain8.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Styles\Plain8.msstyles
          • Size 118KB
          • SHA256 43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\Styles\Windows 7.msstyles
          • Size 385KB
          • SHA256 272d62fa07772fe8c72766a64c923d54f6d92260bbe9a654997d7ef9e21c7b25
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateCheck.exe
          • Path C:\Users\Admin\AppData\Local\Temp\SIBSFX.A2532B90\UpdateCheck.exe
          • Size 49KB
          • SHA256 b643c3492fbcaa195c606d1dae1a320c9e8550d7d65be0e7c04b2e8eef4e8f40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sabtask.xml
          • Path C:\Users\Admin\AppData\Local\Temp\sabtask.xml
          • Size 2KB
          • SHA256 cab61ef9bd58338d1cc4815c0f4725985b41196032c66b5a4d0a92d3bc5f1a6c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4696-133-0x0000000000400000-0x0000000000760000-memory.dmp
          Download

          memory/4912-124-0x0000000000400000-0x0000000000760000-memory.dmp
          Download

          memory/5476-62-0x0000000002430000-0x0000000002431000-memory.dmp
          Download

          memory/5476-125-0x0000000000400000-0x0000000000760000-memory.dmp
          Download