Overview

overview

8

Static

static

3

StartAllBa...ck.exe

windows10-2004-x64

7

StartAllBa...ck.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 11:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    StartAllBack3.9.27.5412-Stable-Repack.exe
  • Size 2.1MB
  • Sample261030-nzd7esyths
  • SHA256 2b04a36a6440b7fc9ddc32ce166c95e4ba022fdd61a50a621e9186d865faa62b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 61 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\StartAllBack3.9.27.5412-Stable-Repack.exe
    "C:\Users\Admin\AppData\Local\Temp\StartAllBack3.9.27.5412-Stable-Repack.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5312
    • C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im StartAllBackCfg.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2240
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe" /install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5756
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe" /install /elevated /silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3816
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks.exe /Delete /TN "\StartIsBack health check" /F
          4⤵
            PID:5228
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2308
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM sndvol.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1268
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM shellhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1380
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM prevhost.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4808
          • C:\Windows\SYSTEM32\tskill.exe
            tskill.exe explorer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5720
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill.exe /F /IM explorer.exe
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3412
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks.exe /Create /TN "\StartAllBack Update" /XML "C:\Users\Admin\AppData\Local\Temp\sabtask.xml"
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:916
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Loads dropped DLL
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Program Files\StartAllBack\UpdateCheck.exe
            "C:\Program Files\StartAllBack\UpdateCheck.exe" reset
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4520
          • C:\Program Files\StartAllBack\DarkMagicLoaderX86.exe
            "C:\Program Files\StartAllBack\DarkMagicLoaderX86.exe" 4520 700
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1872
          • C:\Program Files\StartAllBack\StartAllBackCfg.exe
            "C:\Program Files\StartAllBack\StartAllBackCfg.exe" /welcome
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks SCSI registry key(s)
            • Modifies Control Panel
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3488
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "StartAllBack Update"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5844
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\System32\reg.exe" add "HKCU\Software\StartIsBack" /f /v "DarkMagic" /t REG_DWORD /d "1"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c for /f "tokens=2 delims=," %s in ('whoami /user /fo csv /nh') do (reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\%~s\Connectivity" /f /v "DisableCrossDeviceResume" /t REG_DWORD /d "1" /reg:64 & reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\%~s\Connectivity" /f /v "DisableCrossDeviceResume_ProviderSet" /t REG_DWORD /d "1" /reg:64)
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5528
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c whoami /user /fo csv /nh
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4292
          • C:\Windows\SysWOW64\whoami.exe
            whoami /user /fo csv /nh
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4300
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\S-1-5-21-1404337215-1550464601-2805570857-1000\Connectivity" /f /v "DisableCrossDeviceResume" /t REG_DWORD /d "1" /reg:64
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3312
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\S-1-5-21-1404337215-1550464601-2805570857-1000\Connectivity" /f /v "DisableCrossDeviceResume_ProviderSet" /t REG_DWORD /d "1" /reg:64
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1724
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %k in ('reg query "HKCR\Local Settings\MuiCache" /s ^| findstr /i "AAF68885"') do (reg add "%k" /v "@timedate.cpl,-1189" /t REG_SZ /d 秒 /f)
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c reg query "HKCR\Local Settings\MuiCache" /s | findstr /i "AAF68885"
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\Windows\SysWOW64\reg.exe
            reg query "HKCR\Local Settings\MuiCache" /s
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4432
          • C:\Windows\SysWOW64\findstr.exe
            findstr /i "AAF68885"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6116
    • C:\Windows\System32\ShellHost.exe
      "C:\Windows\System32\ShellHost.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:760

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DarkMagicLoaderX64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DarkMagicLoaderX64.exe
          • Size 13KB
          • SHA256 c59019dd56c201466d5ce317f55be03744b3dcd65bd8dcba97978b6b0628fe57
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicLoaderX86.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DarkMagicLoaderX86.exe
          • Size 13KB
          • SHA256 534635bf9e63c3095e4fb7db2bdafe87ff4791a1c14327c0309c938c614d6173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DarkMagicX64.dll
          • Size 188KB
          • SHA256 04bc430b5656bb8cb70fc061e2a9bbdc2e9179a202db0359b15cc55050682e12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DarkMagicX86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DarkMagicX86.dll
          • Size 156KB
          • SHA256 f720112edc81e986465731ed5d834a025c34671a0ea92e2048e3510b0d616b09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.orb
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orbs\Windows 7.orb
          • Size 295KB
          • SHA256 e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clover.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orbs\clover.svg
          • Size 1KB
          • SHA256 1e0e1ea6149fffe9a6d09a77b404fe17db7d455d1036faebdc168b1ce5869282
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          e1evenorb-pr.png
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orbs\e1evenorb-pr.png
          • Size 167KB
          • SHA256 6e451fe2d887698c4290b830aec1a4a196de22eb3bcf6734b567521bf2d6edf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          w8logo.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Orbs\w8logo.svg
          • Size 713B
          • SHA256 c75684410793a98a051a1cf95395709c73e9589037d47be3f6277b4ac355b7fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 f51c5b5b68f6bc5104188a93f145ca2d6e57d94636fda34e41599bae0e5ec682
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.Computer.Manage.svg
          • Size 4KB
          • SHA256 11b72939689a479cbda2bf96a64774d2ac605c7054cf23deba0663ed4dc11d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 0d4efb27e6c7b774206155dd6abddd2cc85635a467c869c7675da196869a5e2b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.MoveToMenu.svg
          • Size 858B
          • SHA256 40f70db8f7814acf922e25411f82f9d9b9420d30e34f5c6199b8488e260ca13f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 e642c6fa1611e1e937a31bce4b61d1951d6783e3ff633729f86096b67cfe6228
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 8e4de3dfc33b3b3edc2d3b37e95669c9794d98cefefdc50bb6ba02f0937d606c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 2b9a7c378e0160ac8e5843f1ced91021802b677776dcf9ffa71524adbefa1800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 ebfceadfeac8434c464713ec411e1b9059a743ef0e7b676adaba78b005bb877e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\accessmedia.svg
          • Size 634B
          • SHA256 a14b44b414971fae445df013a5de357ff625e4a509bfead3b0c01a74844aa515
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\easyaccess.svg
          • Size 2KB
          • SHA256 6cebc92632e26a4fea23d3e95e3590912f0037f2500ebe576e6d0af54abd4c79
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.SystemProperties.svg
          • Size 3KB
          • SHA256 e99475d76b50f34ec3b1e4346677237d6737fa78bb572b9b7c7fb6837d8a0662
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.folderoptions.svg
          • Size 1019B
          • SHA256 3615ad11593e0fa41c9fcebe32b9e96865cf13a27640f87802aa3c33730a05eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.help.svg
          • Size 3KB
          • SHA256 2aed30dcca71f8d120cffc6b01c318bf1898e62615045fea5e33e1552f289e93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.layout.svg
          • Size 680B
          • SHA256 f39d73c1cd814615aa74ce9fc04a4b7f4c83156b2173875134eaa3f60fb70c7e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.open.svg
          • Size 2KB
          • SHA256 412a37d3e1856910f22c2c35071eae274e3d83047e7a33339f31f501cc5579b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.opencontrolpanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.opencontrolpanel.svg
          • Size 1KB
          • SHA256 bd0c11262c33d08d2f3030d256ae7c16fad62d0050dfc568e9057871db3b5b5a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.pastelink.svg
          • Size 726B
          • SHA256 2e6c18304704c1ae4885abfe8b002c429a4ca7676f0a0cf8e168950d63f7a218
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.removeproperties.svg
          • Size 1KB
          • SHA256 a6a11b85c515027090396db56e7f41036861f3fc00f518e23885566d629b44b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.slideshow.svg
          • Size 4KB
          • SHA256 d384130da33fa213933956306d7ee8bb8377f8dfd3bc4aee588fb453d2b34fd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-dark\windows.troubleshoot.svg
          • Size 617B
          • SHA256 f720372e65c2882f142712338aaeded555129dd4853dd2ccd432613d74707616
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.AddRemovePrograms.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.AddRemovePrograms.svg
          • Size 3KB
          • SHA256 c118dfe2cca3abbe108b9ca2c664305f79e7b348cb142f504e826d04381bf143
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.Computer.Manage.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.Computer.Manage.svg
          • Size 5KB
          • SHA256 24ab22832e298877665641631c70ded68e5f9fc750d5e15f59b65cce06d8b4b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.CopyToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.CopyToMenu.svg
          • Size 2KB
          • SHA256 9d81e9391ee6e6515a573dce662d0d50d4938f81ff640051873667c93c6ac469
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MoveToMenu.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.MoveToMenu.svg
          • Size 1020B
          • SHA256 bf8458615d4d28a96091627aafc0cf6853aaaf93e87bda52e3edc62baff9c5f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.MultiVerb.cmd.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.MultiVerb.cmd.svg
          • Size 4KB
          • SHA256 118e3fd996a8eaa8406d0e98fb76e8224b23e32210543993c71da993e07c368f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.MultiVerb.cmdPromptAsAdministrator.svg
          • Size 2KB
          • SHA256 48ee93c6978fb0bf08e2de11ffccb52e190d9325f7889c9c21442b97167fef1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.RibbonPermissionsDialog.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.RibbonPermissionsDialog.svg
          • Size 2KB
          • SHA256 1fb69fbf893a9c105ef34a722e7bf2bf52cd152f1f5c16d10a5551f9cc3bcfae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Windows.shareprivate.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\Windows.shareprivate.svg
          • Size 3KB
          • SHA256 c3537a0c281a6332ac2a7eb35285b3bc7ec9bda291442d482b98a45b01eed7c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          accessmedia.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\accessmedia.svg
          • Size 868B
          • SHA256 dc2ab9af2b1cd24b11acd4f0ca0e55cbb65d2eac5228a411c2698d0827ffad7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          easyaccess.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\easyaccess.svg
          • Size 2KB
          • SHA256 3a58ece9da8a88a997fb95b0ed8d81f223218f2e089192b451df8a451fcc9800
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.SystemProperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.SystemProperties.svg
          • Size 4KB
          • SHA256 1808bf21c47237f8bb8cde2d014d79281cc41ab8bbffefd929b4d64fdecc2204
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.edit.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.edit.svg
          • Size 1KB
          • SHA256 1e69d480542ecf89010e0947c100605423ec60a92bd87702c72513952065b3b8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.email.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.email.svg
          • Size 853B
          • SHA256 3568a00a810d5984b8c71df89157bed7a34466ae72ac743e2020e8c29fe3df57
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.folderoptions.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.folderoptions.svg
          • Size 1KB
          • SHA256 1b0fbca9b1dad3bd78494ef75632d54f977e22c6835788d00e179af2bc23bafd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.help.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.help.svg
          • Size 3KB
          • SHA256 5cff4abe766fa2c18a0e69d5be21388ddbd90e47ff7316090ba2279ccdf19b6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.layout.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.layout.svg
          • Size 799B
          • SHA256 9b2c371947eec1f36cf20096e33a32aec971a1148646451863aee8a868df6dab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.open.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.open.svg
          • Size 3KB
          • SHA256 644d576f3f86307b5f9448b88dce9f53e4fd40e14fd00317c37efc70f8a6c3b5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.openControlPanel.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.openControlPanel.svg
          • Size 2KB
          • SHA256 942cf1dbbc4b72975e512dca10160d0e0c14bbab067b3a2c50bf9d33b8e22fd1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.pastelink.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.pastelink.svg
          • Size 856B
          • SHA256 7508b21509f19d080ca825c15d3ef4314dc35920f8aff7ffe4ea896f3e384872
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.removeproperties.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.removeproperties.svg
          • Size 2KB
          • SHA256 7f7424bc7c1580d0c6fa842fc0c08ad9a4aad1f2100bd314170a81f242a13e2d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          windows.slideshow.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.slideshow.svg
          • Size 5KB
          • SHA256 b24b24932cc2156d51f7ee5365656f83b358d894860ba921eb353f1664dc22fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windows.troubleshoot.svg
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ribbon\theme-light\windows.troubleshoot.svg
          • Size 736B
          • SHA256 d019f486cc06d5083dda9ac166d538357471ba4076ff0a332ad5a9c048947513
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartAllBackCfg.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
          • Size 3.3MB
          • SHA256 b90887ac351333c2d37025734a68914552ccc4eb03d84bb0c74a77978fc7bb03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackLoaderX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackLoaderX64.dll
          • Size 14KB
          • SHA256 257d83fc29b66b8152daf43065a1471b9f2877957573f5b7e77aeeefc7230027
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartAllBackX64.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackX64.dll
          • Size 1.0MB
          • SHA256 56c2dc60eb02ead04613d163c1839ea1658d90ec86fc5572362357b816cd35ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Plain8.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Styles\Plain8.msstyles
          • Size 118KB
          • SHA256 43c7016d950248f52f9512c9e7393c38d61a3ba2235e5fb6deed83564d8e9442
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Windows 7.msstyles
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Styles\Windows 7.msstyles
          • Size 385KB
          • SHA256 272d62fa07772fe8c72766a64c923d54f6d92260bbe9a654997d7ef9e21c7b25
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateCheck.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\UpdateCheck.exe
          • Size 6KB
          • SHA256 3ec5e595f9b2b9045078acc00bbe88e66b5db2af15bc99b6eed86c4b6da66208
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sabtask.xml
          • Path C:\Users\Admin\AppData\Local\Temp\sabtask.xml
          • Size 2KB
          • SHA256 cab61ef9bd58338d1cc4815c0f4725985b41196032c66b5a4d0a92d3bc5f1a6c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3488-202-0x0000000000400000-0x0000000000764000-memory.dmp
          Download

          memory/3816-189-0x0000000000400000-0x0000000000764000-memory.dmp
          Download

          memory/5756-190-0x0000000000400000-0x0000000000764000-memory.dmp
          Download

          memory/5756-127-0x0000000002440000-0x0000000002441000-memory.dmp
          Download