IOC Report
startuppp.bat

loading gifProcessesMemdumps8642010010Label

Processes

Path
Cmdline
Malicious
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\startuppp.bat" "
 malicious
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\user\Desktop\startuppp.bat" MY_FLAG
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa1.py
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa2.py
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa3.py
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa4.py
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa5.py
 malicious
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
python.exe w4bsa6.py
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\tasklist.exe
tasklist /FI "IMAGENAME eq AvastUI.exe"
C:\Windows\System32\find.exe
find /i "AvastUI.exe"
C:\Windows\System32\tasklist.exe
tasklist /FI "IMAGENAME eq avgui.exe"
C:\Windows\System32\find.exe
find /i "avgui.exe"
There are 4 hidden processes, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
22132028000
heap
page read and write
F680CFC000
stack
page read and write
3B9CBFE000
stack
page read and write
2061382A000
heap
page read and write
189EBE10000
heap
page read and write
F680AFF000
stack
page read and write
26200D70000
heap
page read and write
1664F1C0000
heap
page read and write
225A5FF000
stack
page read and write
1C0DC425000
heap
page read and write
1C0DBF50000
heap
page read and write
24B51270000
heap
page read and write
2213206E000
heap
page read and write
24B51350000
heap
page read and write
F6809FD000
stack
page read and write
20613860000
heap
page read and write
189EA000000
heap
page read and write
C11327F000
stack
page read and write
1D723459000
heap
page read and write
221321F0000
heap
page read and write
B44D8FF000
stack
page read and write
F6806F7000
stack
page read and write
225A7FD000
stack
page read and write
22132385000
heap
page read and write
85ECAFD000
stack
page read and write
1664F445000
heap
page read and write
26200E49000
heap
page read and write
3B9D0FC000
stack
page read and write
189EA002000
heap
page read and write
1748FFE000
stack
page read and write
26200E2A000
heap
page read and write
189EA013000
heap
page read and write
20613846000
heap
page read and write
17490FD000
stack
page read and write
26200F02000
heap
page read and write
2095AC30000
heap
page read and write
20613813000
heap
page read and write
17E68E58000
heap
page read and write
1748EFE000
stack
page read and write
24B51655000
heap
page read and write
9782D0F000
stack
page read and write
B44D7FE000
stack
page read and write
17491FE000
stack
page read and write
B44DBFD000
stack
page read and write
37FCC7F000
stack
page read and write
24B51370000
heap
page read and write
85EC9FF000
stack
page read and write
1C0DC030000
heap
page read and write
3B9CDFD000
stack
page read and write
1D7233E0000
heap
page read and write
22132057000
heap
page read and write
2213206E000
heap
page read and write
206136B0000
heap
page read and write
2095AE69000
heap
page read and write
1664F21B000
heap
page read and write
37FCCFE000
stack
page read and write
24B51447000
heap
page read and write
2213204B000
heap
page read and write
9782D8F000
stack
page read and write
9782C8C000
stack
page read and write
37FCDFE000
stack
page read and write
24B51440000
heap
page read and write
1A5D68B000
stack
page read and write
26200E13000
heap
page read and write
85EC8FD000
stack
page read and write
1A5DB7E000
stack
page read and write
85EC387000
stack
page read and write
189EC002000
heap
page read and write
2095AF02000
heap
page read and write
22132020000
heap
page read and write
26200E59000
heap
page read and write
1664F22B000
heap
page read and write
3B9C717000
stack
page read and write
1664F0E0000
heap
page read and write
1A5DAFF000
stack
page read and write
17E68E3D000
heap
page read and write
17492FD000
stack
page read and write
1D72342A000
heap
page read and write
1D723402000
heap
page read and write
17E68DC0000
heap
page read and write
22132045000
heap
page read and write
1C0DC050000
heap
page read and write
225AAFC000
stack
page read and write
1664F23D000
heap
page read and write
B44DAFF000
stack
page read and write
17493FC000
stack
page read and write
1C0DC420000
heap
page read and write
1D723460000
heap
page read and write
206136D0000
heap
page read and write
37FCD7E000
stack
page read and write
2095AE60000
heap
page read and write
189E9ED0000
heap
page read and write
1D72343D000
heap
page read and write
37FC94B000
stack
page read and write
189EA102000
heap
page read and write
225A6FF000
stack
page read and write
1664F23D000
heap
page read and write
1D723449000
heap
page read and write
1C0DC13B000
heap
page read and write
17E68DF0000
heap
page read and write
1664F228000
heap
page read and write
2095CC02000
heap
page read and write
26200C90000
heap
page read and write
2095AE13000
heap
page read and write
1A5D70E000
stack
page read and write
1D723413000
heap
page read and write
20613869000
heap
page read and write
225A4F7000
stack
page read and write
17E68E02000
heap
page read and write
225A8FF000
stack
page read and write
1D725320000
heap
page read and write
3B9CAFD000
stack
page read and write
2095AE2A000
heap
page read and write
20613902000
heap
page read and write
206137B0000
heap
page read and write
1A5D78E000
stack
page read and write
37FC9CF000
stack
page read and write
F680BFE000
stack
page read and write
1D725402000
heap
page read and write
1664F22B000
heap
page read and write
189E9EB0000
heap
page read and write
17E68E60000
heap
page read and write
2095AE00000
heap
page read and write
189EA049000
heap
page read and write
24B51650000
heap
page read and write
20613800000
heap
page read and write
F6808FE000
stack
page read and write
17E68E49000
heap
page read and write
17E6AE02000
heap
page read and write
1A5DA7E000
stack
page read and write
189EA060000
heap
page read and write
1664F215000
heap
page read and write
1C0DC130000
heap
page read and write
85ECBFC000
stack
page read and write
22132380000
heap
page read and write
1664F2F0000
heap
page read and write
1D7233C0000
heap
page read and write
1C0DC138000
heap
page read and write
22132058000
heap
page read and write
1D723502000
heap
page read and write
B44D6F7000
stack
page read and write
24B5144A000
heap
page read and write
3B9CEFF000
stack
page read and write
17E6AD20000
heap
page read and write
2095AE49000
heap
page read and write
3B9CCFF000
stack
page read and write
2095AE02000
heap
page read and write
F6807FE000
stack
page read and write
1664F1F0000
heap
page read and write
1664F22B000
heap
page read and write
20615610000
heap
page read and write
2095AD30000
heap
page read and write
B44D9FD000
stack
page read and write
26202BD0000
heap
page read and write
26200E60000
heap
page read and write
1664F1F8000
heap
page read and write
22131FF0000
heap
page read and write
B44DCFC000
stack
page read and write
2061384A000
heap
page read and write
17E68E00000
heap
page read and write
85EC7FD000
stack
page read and write
189E9FB0000
heap
page read and write
1D723400000
heap
page read and write
20613802000
heap
page read and write
189EA02A000
heap
page read and write
1D7233F0000
heap
page read and write
26202C02000
heap
page read and write
17E68E2A000
heap
page read and write
189EA056000
heap
page read and write
2095AC50000
heap
page read and write
85EC6FE000
stack
page read and write
1664F440000
heap
page read and write
2095CB90000
heap
page read and write
2213206E000
heap
page read and write
20613857000
heap
page read and write
20615802000
heap
page read and write
3B9CFFD000
stack
page read and write
1A5DBFE000
stack
page read and write
1748BB8000
stack
page read and write
26200C70000
heap
page read and write
26200E00000
heap
page read and write
17E68F02000
heap
page read and write
1664F227000
heap
page read and write
17E68DE0000
heap
page read and write
225A9FE000
stack
page read and write
C112F6C000
stack
page read and write
C112FEF000
stack
page read and write
17E68E13000
heap
page read and write
1664F23D000
heap
page read and write
22132000000
heap
page read and write
26200E02000
heap
page read and write
There are 181 hidden memdumps, click here to show them.