{ "started": "2026-10-31T08:05:59.1716311+00:00", "attempts": { "afterInstall": { "files": [ "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicLoaderX64.exe 13720", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicLoaderX86.exe 13720", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicX64.dll 192936", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicX86.dll 160424", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackCfg.exe 3518680", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackLoaderX64.dll 14744", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll 1054440", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\UpdateCheck.exe 50400", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\clover.svg 1834", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\e1evenorb-pr.png 171231", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\w8logo.svg 713", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\Windows 7.orb 302080", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\accessmedia.svg 634", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\easyaccess.svg 2708", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.AddRemovePrograms.svg 3435", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.Computer.Manage.svg 4169", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.CopyToMenu.svg 2106", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.folderoptions.svg 1019", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.help.svg 3830", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.layout.svg 680", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MoveToMenu.svg 858", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmd.svg 4268", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2484", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.open.svg 2920", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.opencontrolpanel.svg 1980", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.pastelink.svg 726", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.removeproperties.svg 1553", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.RibbonPermissionsDialog.svg 2065", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.shareprivate.svg 3185", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.slideshow.svg 4206", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.SystemProperties.svg 3465", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.troubleshoot.svg 617", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\accessmedia.svg 868", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\easyaccess.svg 2772", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.AddRemovePrograms.svg 3387", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.Computer.Manage.svg 5328", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.CopyToMenu.svg 2807", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.edit.svg 1265", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.email.svg 853", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.folderoptions.svg 1209", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.help.svg 3853", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.layout.svg 799", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MoveToMenu.svg 1020", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmd.svg 4253", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2481", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.open.svg 4038", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.openControlPanel.svg 2846", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.pastelink.svg 856", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.removeproperties.svg 2063", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.RibbonPermissionsDialog.svg 2147", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.shareprivate.svg 3377", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.slideshow.svg 5156", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.SystemProperties.svg 4814", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.troubleshoot.svg 736", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Styles\\Plain8.msstyles 120832", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Styles\\Windows 7.msstyles 394752" ], "run": { "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AzureArcSetup": "C:\\Windows\\AzureArcSetup\\Systray\\AzureArcSysTray.exe", "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityHealth": "C:\\Windows\\system32\\SecurityHealthSystray.exe" }, "tasks": [ ], "registry": { "HKEY_CURRENT_USER\\Software\\StartIsBack\\": "" }, "enableLUA": 1, "com": [ "HKCU:\\Software\\Classes\\CLSID\\{117E3954-5034-453A-A18B-7B79493646E6} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackLoaderX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{865e5e76-ad83-4dca-a109-50dc2113ce9b} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BA} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BB} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da97} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{AD1405D2-30CF-4877-8468-1EE1C52C759F} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll" ], "processes": [ ], "explorerModules": [ "C:\\Windows\\explorer.exe", "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.DesktopHosting.dll", "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher.dll", "C:\\Windows\\ShellExperiences\\TileControl.dll", "C:\\Windows\\ShellComponents\\WindowsInternal.ShellUI.dll" ], "loaded": false, "topWindows": [ "Shell_TrayWnd | | explorer", "#32770 | Performance Options | SystemPropertiesPerformance", "CASCADIA_HOSTING_WINDOW_CLASS | C:\\ProgramData\\GitHub\\HostedComputeAgent\\hosted-compute-agent | WindowsTerminal", "Progman | Program Manager | explorer" ], "signInActions": [ ] }, "afterSignInSimulation": { "files": [ "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicLoaderX64.exe 13720", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicLoaderX86.exe 13720", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicX64.dll 192936", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\DarkMagicX86.dll 160424", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackCfg.exe 3518680", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackLoaderX64.dll 14744", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll 1054440", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\UpdateCheck.exe 50400", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\clover.svg 1834", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\e1evenorb-pr.png 171231", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\w8logo.svg 713", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Orbs\\Windows 7.orb 302080", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\accessmedia.svg 634", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\easyaccess.svg 2708", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.AddRemovePrograms.svg 3435", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.Computer.Manage.svg 4169", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.CopyToMenu.svg 2106", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.folderoptions.svg 1019", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.help.svg 3830", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.layout.svg 680", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MoveToMenu.svg 858", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmd.svg 4268", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2484", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.open.svg 2920", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.opencontrolpanel.svg 1980", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.pastelink.svg 726", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.removeproperties.svg 1553", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.RibbonPermissionsDialog.svg 2065", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\Windows.shareprivate.svg 3185", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.slideshow.svg 4206", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.SystemProperties.svg 3465", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-dark\\windows.troubleshoot.svg 617", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\accessmedia.svg 868", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\easyaccess.svg 2772", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.AddRemovePrograms.svg 3387", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.Computer.Manage.svg 5328", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.CopyToMenu.svg 2807", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.edit.svg 1265", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.email.svg 853", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.folderoptions.svg 1209", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.help.svg 3853", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.layout.svg 799", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MoveToMenu.svg 1020", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmd.svg 4253", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2481", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.open.svg 4038", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.openControlPanel.svg 2846", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.pastelink.svg 856", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.removeproperties.svg 2063", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.RibbonPermissionsDialog.svg 2147", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\Windows.shareprivate.svg 3377", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.slideshow.svg 5156", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.SystemProperties.svg 4814", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Ribbon\\theme-light\\windows.troubleshoot.svg 736", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Styles\\Plain8.msstyles 120832", "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Styles\\Windows 7.msstyles 394752" ], "run": { "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AzureArcSetup": "C:\\Windows\\AzureArcSetup\\Systray\\AzureArcSysTray.exe", "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityHealth": "C:\\Windows\\system32\\SecurityHealthSystray.exe" }, "tasks": [ ], "registry": { "HKEY_CURRENT_USER\\Software\\StartIsBack\\": "" }, "enableLUA": 1, "com": [ "HKCU:\\Software\\Classes\\CLSID\\{117E3954-5034-453A-A18B-7B79493646E6} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackLoaderX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{865e5e76-ad83-4dca-a109-50dc2113ce9b} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BA} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BB} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da97} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{AD1405D2-30CF-4877-8468-1EE1C52C759F} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll", "HKCU:\\Software\\Classes\\CLSID\\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E} = C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\StartAllBackX64.dll" ], "processes": [ ], "explorerModules": [ "C:\\Windows\\Explorer.EXE", "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.DesktopHosting.dll", "C:\\Windows\\ShellComponents\\WindowsInternal.ComposableShell.Experiences.Switcher.dll", "C:\\Windows\\ShellExperiences\\TileControl.dll", "C:\\Windows\\ShellComponents\\WindowsInternal.ShellUI.dll" ], "loaded": false, "topWindows": [ "Shell_TrayWnd | | explorer", "#32770 | Performance Options | SystemPropertiesPerformance", "CASCADIA_HOSTING_WINDOW_CLASS | C:\\ProgramData\\GitHub\\HostedComputeAgent\\hosted-compute-agent | WindowsTerminal", "Progman | Program Manager | explorer" ] }, "afterAllUsersInstall": { "files": [ "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Cache\\appsfolder.dat 5163", "C:\\Program Files\\StartAllBack\\DarkMagicLoaderX64.exe 13720", "C:\\Program Files\\StartAllBack\\DarkMagicLoaderX86.exe 13720", "C:\\Program Files\\StartAllBack\\DarkMagicX64.dll 192936", "C:\\Program Files\\StartAllBack\\DarkMagicX86.dll 160424", "C:\\Program Files\\StartAllBack\\StartAllBackCfg.exe 3518680", "C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll 14744", "C:\\Program Files\\StartAllBack\\StartAllBackX64.dll 1054440", "C:\\Program Files\\StartAllBack\\UpdateCheck.exe 50400", "C:\\Program Files\\StartAllBack\\Orbs\\clover.svg 1834", "C:\\Program Files\\StartAllBack\\Orbs\\e1evenorb-pr.png 171231", "C:\\Program Files\\StartAllBack\\Orbs\\w8logo.svg 713", "C:\\Program Files\\StartAllBack\\Orbs\\Windows 7.orb 302080", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\accessmedia.svg 634", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\easyaccess.svg 2708", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.AddRemovePrograms.svg 3435", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.Computer.Manage.svg 4169", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.CopyToMenu.svg 2106", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.folderoptions.svg 1019", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.help.svg 3830", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.layout.svg 680", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MoveToMenu.svg 858", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmd.svg 4268", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2484", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.open.svg 2920", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.opencontrolpanel.svg 1980", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.pastelink.svg 726", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.removeproperties.svg 1553", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.RibbonPermissionsDialog.svg 2065", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.shareprivate.svg 3185", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.slideshow.svg 4206", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.SystemProperties.svg 3465", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.troubleshoot.svg 617", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\accessmedia.svg 868", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\easyaccess.svg 2772", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.AddRemovePrograms.svg 3387", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.Computer.Manage.svg 5328", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.CopyToMenu.svg 2807", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.edit.svg 1265", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.email.svg 853", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.folderoptions.svg 1209", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.help.svg 3853", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.layout.svg 799", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MoveToMenu.svg 1020", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmd.svg 4253", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2481", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.open.svg 4038", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.openControlPanel.svg 2846", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.pastelink.svg 856", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.removeproperties.svg 2063", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.RibbonPermissionsDialog.svg 2147", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.shareprivate.svg 3377", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.slideshow.svg 5156", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.SystemProperties.svg 4814", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.troubleshoot.svg 736", "C:\\Program Files\\StartAllBack\\Styles\\Plain8.msstyles 120832", "C:\\Program Files\\StartAllBack\\Styles\\Windows 7.msstyles 394752" ], "run": { "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AzureArcSetup": "C:\\Windows\\AzureArcSetup\\Systray\\AzureArcSysTray.exe", "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityHealth": "C:\\Windows\\system32\\SecurityHealthSystray.exe" }, "tasks": [ "\\StartAllBack Update | \"C:\\Program Files\\StartAllBack\\UpdateCheck.exe\" elevated | Ready" ], "registry": { "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinBuild": "26100", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinLangID": "1033", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinUBR": "33650", "HKEY_CURRENT_USER\\Software\\StartIsBack\\SettingsVersion": "6", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WelcomeShown": "3", "HKEY_CURRENT_USER\\Software\\StartIsBack\\UpdateCheck": "9 66 5 228 14 105 221 1", "HKEY_CURRENT_USER\\Software\\StartIsBack\\FrameStyle": "1", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\OrbWidth.96": "48", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\OrbHeight.96": "40", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealHeight.9": "131082", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealWidth.9": "Control Panel", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealHeight.6": "2", "HKEY_CURRENT_USER\\Software\\StartIsBack\\DarkMagic\\": "", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Recolor\\": "", "HKEY_LOCAL_MACHINE\\Software\\StartIsBack\\": "", "HKEY_LOCAL_MACHINE\\Software\\StartIsBack\\License\\": "" }, "enableLUA": 1, "com": [ "HKLM:\\Software\\Classes\\CLSID\\{117E3954-5034-453A-A18B-7B79493646E6} = C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{865e5e76-ad83-4dca-a109-50dc2113ce9b} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BA} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BB} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da97} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{AD1405D2-30CF-4877-8468-1EE1C52C759F} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll" ], "processes": [ "StartAllBackCfg C:\\Program Files\\StartAllBack\\StartAllBackCfg.exe" ], "explorerModules": [ "C:\\Windows\\explorer.exe", "C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll", "C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "C:\\Program Files\\StartAllBack\\DarkMagicX64.dll", "C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" ], "loaded": true, "topWindows": [ "Shell_TrayWnd | | explorer", "#32770 | Performance Options | SystemPropertiesPerformance", "TMain | StartAllBack configuration | StartAllBackCfg", "CASCADIA_HOSTING_WINDOW_CLASS | C:\\ProgramData\\GitHub\\HostedComputeAgent\\hosted-compute-agent | WindowsTerminal", "Progman | Program Manager | explorer" ] }, "afterAllUsersRestart": { "files": [ "C:\\Users\\runneradmin\\AppData\\Local\\StartAllBack\\Cache\\appsfolder.dat 5163", "C:\\Program Files\\StartAllBack\\DarkMagicLoaderX64.exe 13720", "C:\\Program Files\\StartAllBack\\DarkMagicLoaderX86.exe 13720", "C:\\Program Files\\StartAllBack\\DarkMagicX64.dll 192936", "C:\\Program Files\\StartAllBack\\DarkMagicX86.dll 160424", "C:\\Program Files\\StartAllBack\\StartAllBackCfg.exe 3518680", "C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll 14744", "C:\\Program Files\\StartAllBack\\StartAllBackX64.dll 1054440", "C:\\Program Files\\StartAllBack\\UpdateCheck.exe 50400", "C:\\Program Files\\StartAllBack\\Orbs\\clover.svg 1834", "C:\\Program Files\\StartAllBack\\Orbs\\e1evenorb-pr.png 171231", "C:\\Program Files\\StartAllBack\\Orbs\\w8logo.svg 713", "C:\\Program Files\\StartAllBack\\Orbs\\Windows 7.orb 302080", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\accessmedia.svg 634", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\easyaccess.svg 2708", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.AddRemovePrograms.svg 3435", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.Computer.Manage.svg 4169", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.CopyToMenu.svg 2106", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.folderoptions.svg 1019", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.help.svg 3830", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.layout.svg 680", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MoveToMenu.svg 858", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmd.svg 4268", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2484", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.open.svg 2920", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.opencontrolpanel.svg 1980", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.pastelink.svg 726", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.removeproperties.svg 1553", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.RibbonPermissionsDialog.svg 2065", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\Windows.shareprivate.svg 3185", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.slideshow.svg 4206", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.SystemProperties.svg 3465", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-dark\\windows.troubleshoot.svg 617", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\accessmedia.svg 868", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\easyaccess.svg 2772", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.AddRemovePrograms.svg 3387", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.Computer.Manage.svg 5328", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.CopyToMenu.svg 2807", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.edit.svg 1265", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.email.svg 853", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.folderoptions.svg 1209", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.help.svg 3853", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.layout.svg 799", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MoveToMenu.svg 1020", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmd.svg 4253", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.MultiVerb.cmdPromptAsAdministrator.svg 2481", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.open.svg 4038", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.openControlPanel.svg 2846", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.pastelink.svg 856", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.removeproperties.svg 2063", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.RibbonPermissionsDialog.svg 2147", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\Windows.shareprivate.svg 3377", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.slideshow.svg 5156", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.SystemProperties.svg 4814", "C:\\Program Files\\StartAllBack\\Ribbon\\theme-light\\windows.troubleshoot.svg 736", "C:\\Program Files\\StartAllBack\\Styles\\Plain8.msstyles 120832", "C:\\Program Files\\StartAllBack\\Styles\\Windows 7.msstyles 394752" ], "run": { "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AzureArcSetup": "C:\\Windows\\AzureArcSetup\\Systray\\AzureArcSysTray.exe", "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityHealth": "C:\\Windows\\system32\\SecurityHealthSystray.exe" }, "tasks": [ "\\StartAllBack Update | \"C:\\Program Files\\StartAllBack\\UpdateCheck.exe\" elevated | Ready" ], "registry": { "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinBuild": "26100", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinLangID": "1033", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WinUBR": "33650", "HKEY_CURRENT_USER\\Software\\StartIsBack\\SettingsVersion": "6", "HKEY_CURRENT_USER\\Software\\StartIsBack\\WelcomeShown": "3", "HKEY_CURRENT_USER\\Software\\StartIsBack\\UpdateCheck": "89 82 178 244 14 105 221 1", "HKEY_CURRENT_USER\\Software\\StartIsBack\\FrameStyle": "1", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\OrbWidth.96": "48", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\OrbHeight.96": "40", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealHeight.9": "131082", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealWidth.9": "Control Panel", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Cache\\IdealHeight.6": "2", "HKEY_CURRENT_USER\\Software\\StartIsBack\\DarkMagic\\": "", "HKEY_CURRENT_USER\\Software\\StartIsBack\\Recolor\\": "", "HKEY_LOCAL_MACHINE\\Software\\StartIsBack\\": "", "HKEY_LOCAL_MACHINE\\Software\\StartIsBack\\License\\": "" }, "enableLUA": 1, "com": [ "HKLM:\\Software\\Classes\\CLSID\\{117E3954-5034-453A-A18B-7B79493646E6} = C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{865e5e76-ad83-4dca-a109-50dc2113ce9b} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BA} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{99E2B362-3E4E-4255-9B29-41A7F40777BB} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da97} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{AD1405D2-30CF-4877-8468-1EE1C52C759F} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "HKLM:\\Software\\Classes\\CLSID\\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E} = C:\\Program Files\\StartAllBack\\StartAllBackX64.dll" ], "processes": [ "StartAllBackCfg C:\\Program Files\\StartAllBack\\StartAllBackCfg.exe" ], "explorerModules": [ "C:\\Windows\\Explorer.EXE", "C:\\Program Files\\StartAllBack\\StartAllBackLoaderX64.dll", "C:\\Program Files\\StartAllBack\\StartAllBackX64.dll", "C:\\Program Files\\StartAllBack\\DarkMagicX64.dll", "C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" ], "loaded": true, "topWindows": [ "Shell_TrayWnd | | explorer", "#32770 | Performance Options | SystemPropertiesPerformance", "TMain | StartAllBack configuration | StartAllBackCfg", "CASCADIA_HOSTING_WINDOW_CLASS | C:\\ProgramData\\GitHub\\HostedComputeAgent\\hosted-compute-agent | WindowsTerminal", "Progman | Program Manager | explorer" ] } }, "machine": { "os": "Microsoft Windows Server 2025 Datacenter", "edition": "ServerDatacenter", "installationType": "Server", "build": "26100.33650", "displayVersion": "24H2", "arch": "AMD64", "explorerPath": "C:\\Windows\\Explorer.EXE" }, "setup": { "version": "3.9.28", "url": "https://startisback.sfo3.cdn.digitaloceanspaces.com/StartAllBack_3.9.28_setup.exe", "sha256": "a760f333f6e3305e7f0e4a09982da129d01003752aa2260513a583f5e5be7b29", "matchesManifest": true, "signature": "Valid", "perUserExit": 0, "perUserUninstallExit": 0, "perUserFolderLeft": true, "windowTexts": [ "Install for everyone", "Install for me", "panBottom", "Automatically download and install updates", "Cancel" ], "clicked": "Install for everyone", "allUsersExit": 0 }, "finished": "2026-10-31T08:09:38.6569342+00:00" }