File name:

Medicat_Installer.bat

Full analysis: https://app.any.run/tasks/91475610-285c-4df6-b4e2-ee38f75654d7
Verdict: Malicious activity
Analysis date: February 09, 2025, 00:02:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
arch-scr
arch-doc
arch-html
arch-exec
bittorrent
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with escape sequences
MD5:

43E14B2C0E7E5FD8F0ED3A98B4DF67D1

SHA1:

7BEF25B7ECCEFA7F5528FC6973937DA56D10BE4C

SHA256:

9C1C2D2E0C0D8E216C2E1269E339E01169BD0DD40939016F3FE3F12646965334

SSDEEP:

192:UMCw3UbaLX13a7BJ2ZOTH5mkuEYb+oMGR3EUgXLcHgKjAZqNrF8rzGF86kWyz5Bj:Kw3KaLcH5mk4cANAEAYpNe1+r2tP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (RemoteSigned)

      • cmd.exe (PID: 7020)

    • BITTORRENT has been detected (SURICATA)

      • aria2c.exe (PID: 968)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 6280)
      • cmd.exe (PID: 7020)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6280)
      • powershell.exe (PID: 6612)
      • cmd.exe (PID: 7020)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6280)
      • cmd.exe (PID: 7020)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6280)
      • cmd.exe (PID: 7020)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6280)
      • cmd.exe (PID: 7020)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 6612)

    • Download files or web resources using Curl/Wget

      • cmd.exe (PID: 7020)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 7020)

    • Executable content was dropped or overwritten

      • curl.exe (PID: 5876)
      • curl.exe (PID: 3620)
      • curl.exe (PID: 4952)
      • curl.exe (PID: 3208)
      • curl.exe (PID: 4128)
      • curl.exe (PID: 4672)
      • 7z.exe (PID: 1328)
      • curl.exe (PID: 6716)

    • Drops 7-zip archiver for unpacking

      • curl.exe (PID: 3208)
      • curl.exe (PID: 4672)

    • The executable file from the user directory is run by the CMD process

      • batbox.exe (PID: 4308)
      • batbox.exe (PID: 7040)
      • batbox.exe (PID: 7080)
      • batbox.exe (PID: 4328)
      • batbox.exe (PID: 5992)
      • batbox.exe (PID: 3152)
      • 7z.exe (PID: 1328)
      • GetInput.exe (PID: 3568)
      • GetInput.exe (PID: 7000)
      • folderbrowse.exe (PID: 4576)
      • batbox.exe (PID: 6268)
      • batbox.exe (PID: 6984)
      • batbox.exe (PID: 6484)
      • batbox.exe (PID: 4360)
      • GetInput.exe (PID: 3824)
      • batbox.exe (PID: 3896)
      • Ventoy2Disk.exe (PID: 2624)
      • batbox.exe (PID: 3900)
      • batbox.exe (PID: 6652)
      • GetInput.exe (PID: 1468)
      • batbox.exe (PID: 5776)
      • batbox.exe (PID: 3688)
      • batbox.exe (PID: 7116)
      • GetInput.exe (PID: 900)
      • batbox.exe (PID: 6464)
      • batbox.exe (PID: 6448)
      • aria2c.exe (PID: 968)

    • The process executes Powershell scripts

      • cmd.exe (PID: 7020)

    • Detected use of alternative data streams (AltDS)

      • format.com (PID: 6492)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7020)

    • Potential Corporate Privacy Violation

      • aria2c.exe (PID: 968)

    • Connects to unusual port

      • aria2c.exe (PID: 968)

  • INFO

    • Execution of CURL command

      • cmd.exe (PID: 6280)
      • cmd.exe (PID: 7020)

    • Checks supported languages

      • curl.exe (PID: 6532)
      • curl.exe (PID: 2432)
      • mode.com (PID: 716)
      • curl.exe (PID: 6248)
      • curl.exe (PID: 6348)
      • curl.exe (PID: 2008)
      • curl.exe (PID: 5876)
      • curl.exe (PID: 6600)
      • curl.exe (PID: 3620)
      • curl.exe (PID: 4952)
      • curl.exe (PID: 3208)
      • curl.exe (PID: 4128)
      • curl.exe (PID: 5788)
      • curl.exe (PID: 4764)
      • curl.exe (PID: 4672)
      • mode.com (PID: 6764)
      • batbox.exe (PID: 4328)
      • mode.com (PID: 4400)
      • batbox.exe (PID: 7040)
      • batbox.exe (PID: 4308)
      • batbox.exe (PID: 3152)
      • batbox.exe (PID: 7080)
      • batbox.exe (PID: 5992)
      • mode.com (PID: 6748)
      • curl.exe (PID: 4912)
      • folderbrowse.exe (PID: 4576)
      • mode.com (PID: 3128)
      • 7z.exe (PID: 1328)
      • mode.com (PID: 7048)
      • batbox.exe (PID: 6484)
      • batbox.exe (PID: 6984)
      • batbox.exe (PID: 6268)
      • batbox.exe (PID: 4360)
      • batbox.exe (PID: 3900)
      • batbox.exe (PID: 3896)
      • Ventoy2Disk.exe (PID: 2624)
      • mode.com (PID: 6524)
      • format.com (PID: 6492)
      • batbox.exe (PID: 6464)
      • mode.com (PID: 6428)
      • batbox.exe (PID: 6652)
      • mode.com (PID: 3144)
      • batbox.exe (PID: 5776)
      • batbox.exe (PID: 7116)
      • batbox.exe (PID: 3688)
      • curl.exe (PID: 5988)
      • curl.exe (PID: 6076)
      • batbox.exe (PID: 6448)
      • aria2c.exe (PID: 968)
      • curl.exe (PID: 6716)

    • Checks operating system version

      • cmd.exe (PID: 7020)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 716)
      • mode.com (PID: 6764)
      • mode.com (PID: 6748)
      • mode.com (PID: 4400)
      • mode.com (PID: 3128)
      • mode.com (PID: 7048)
      • mode.com (PID: 6524)
      • mode.com (PID: 6428)
      • mode.com (PID: 3144)

    • Disables trace logs

      • powershell.exe (PID: 1296)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 7160)
      • powershell.exe (PID: 2132)

    • Checks proxy server information

      • powershell.exe (PID: 1296)
      • powershell.exe (PID: 6740)
      • powershell.exe (PID: 7160)
      • powershell.exe (PID: 2132)

    • Reads the computer name

      • curl.exe (PID: 5876)
      • curl.exe (PID: 6248)
      • curl.exe (PID: 6348)
      • curl.exe (PID: 2008)
      • curl.exe (PID: 3208)
      • curl.exe (PID: 6600)
      • curl.exe (PID: 3620)
      • curl.exe (PID: 4952)
      • curl.exe (PID: 4128)
      • curl.exe (PID: 4672)
      • curl.exe (PID: 4764)
      • curl.exe (PID: 5788)
      • curl.exe (PID: 4912)
      • 7z.exe (PID: 1328)
      • folderbrowse.exe (PID: 4576)
      • curl.exe (PID: 5988)
      • curl.exe (PID: 6716)
      • aria2c.exe (PID: 968)
      • curl.exe (PID: 6076)

    • Create files in a temporary directory

      • curl.exe (PID: 5876)
      • curl.exe (PID: 6248)
      • curl.exe (PID: 6348)
      • curl.exe (PID: 2008)
      • curl.exe (PID: 4952)
      • curl.exe (PID: 6600)
      • curl.exe (PID: 3620)
      • curl.exe (PID: 3208)
      • curl.exe (PID: 4128)
      • curl.exe (PID: 5788)
      • curl.exe (PID: 4672)
      • curl.exe (PID: 4764)
      • curl.exe (PID: 4912)
      • 7z.exe (PID: 1328)
      • Ventoy2Disk.exe (PID: 2624)
      • curl.exe (PID: 5988)
      • curl.exe (PID: 6076)
      • curl.exe (PID: 6716)
      • aria2c.exe (PID: 968)

    • The sample compiled with english language support

      • curl.exe (PID: 5876)
      • curl.exe (PID: 3208)
      • curl.exe (PID: 4672)

    • Reads the machine GUID from the registry

      • aria2c.exe (PID: 968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
217
Monitored processes
85
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs ping.exe no specs curl.exe no specs timeout.exe no specs reg.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs reg.exe no specs ping.exe no specs curl.exe no specs timeout.exe no specs reg.exe no specs cmd.exe no specs timeout.exe no specs mode.com no specs powershell.exe ping.exe no specs curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe curl.exe powershell.exe no specs powershell.exe no specs mode.com no specs mode.com no specs powershell.exe mode.com no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs powershell.exe getinput.exe no specs timeout.exe no specs powershell.exe timeout.exe no specs timeout.exe no specs curl.exe 7z.exe timeout.exe no specs mode.com no specs cmd.exe no specs folderbrowse.exe no specs ping.exe no specs mode.com no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs mode.com no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs ventoy2disk.exe no specs format.com no specs mode.com no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs mode.com no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs curl.exe curl.exe curl.exe #BITTORRENT aria2c.exe

Process information

PID
CMD
Path
Indicators
Parent process
716mode con:cols=64 lines=18C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
900GetInput /M 15 6 25 8 40 6 46 8 /H 2F 2F C:\Users\admin\AppData\Local\Temp\bin\GetInput.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\bin\getinput.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
968aria2c.exe --file-allocation=none --seed-time=0 medicat.torrentC:\Users\admin\AppData\Local\Temp\aria2c.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\aria2c.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1296powershell -c "$data = curl https://api.github.com/repos/mon5termatt/medicat_installer/git/refs/tag -UseBasicParsing | ConvertFrom-Json; $data[-1].ref -replace 'refs/tags/', '' | Out-File -Encoding 'UTF8' -FilePath './curver.ini'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
13287z x ventoy.zip -r -aoaC:\Users\admin\AppData\Local\Temp\bin\7z.exe
cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\appdata\local\temp\bin\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1468GetInput /M 10 12 16 14 46 12 51 14 /H 2F 4F C:\Users\admin\AppData\Local\Temp\bin\GetInput.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\bin\getinput.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
1684Powershell -c "Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1868PING localhost -n 6 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
2008curl "https://raw.githubusercontent.com/mon5termatt/medicat_installer/main/bin/Button.bat" -o ./bin/Button.bat -s -LC:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
HIGH
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
2040timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
38 983
Read events
38 979
Write events
4
Delete events
0

Modification events

(PID) Process:(5240) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
Operation:writeName:ExecutionPolicy
Value:
RemoteSigned
(PID) Process:(1684) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
Operation:writeName:ExecutionPolicy
Value:
RemoteSigned
(PID) Process:(4576) folderbrowse.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(4576) folderbrowse.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
Executable files
15
Suspicious files
10
Text files
57
Unknown types
0

Dropped files

PID
Process
Filename
Type
6612powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kbcgcqvr.vyp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2vbeyyx1.zqu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1296powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3oznwhms.km5.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1296powershell.exeC:\Users\admin\AppData\Local\Temp\curver.initext
MD5:98995EA103B6D9384BDC22590C7FF2AF
SHA256:AE7062214D11FB30F4A56750478500107C3B8423D23EF8EA6B1EC84CFD720879
6248curl.exeC:\Users\admin\AppData\Local\Temp\bin\QuickSFV.initext
MD5:7BE5A47066EDCCD7AA0D3B0D69D607FF
SHA256:2EEA3FA7D366D65C1B27B1D0796FDD9F560E289A6FA9F24DD339E5131D0B099B
2008curl.exeC:\Users\admin\AppData\Local\Temp\bin\Button.battext
MD5:5B727EFF91DE52000CEA8E61694F2A03
SHA256:03A86F9FCDCCBAA499EA4435434A45178E367639D8FB755C5211F304C70744B5
6612powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_f2nqx3ul.dcp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6612powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:33C0CD0FC1BF117464C631D883A5BA1E
SHA256:DFB793CDDDB73960F41218CE5B5EF99CD0BF4D930BD370702E8574709F99E878
5240powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z0e4awvf.0bj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5788curl.exeC:\Users\admin\AppData\Local\Temp\bin\licence.ps1text
MD5:D68913D13961BE1091A02B062858A851
SHA256:8087C3F37914408F2900E94BA63836A23499DB3781103901800F4621C5B84887
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
148
DNS requests
31
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5732
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5732
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6464
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6808
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6808
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5732
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5732
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
6136
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.4
  • 40.126.31.73
  • 40.126.31.131
  • 20.190.159.73
  • 40.126.31.67
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
968
aria2c.exe
Potential Corporate Privacy Violation
ET P2P Vuze BT UDP Connection (5)
968
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
968
aria2c.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT nodes reply
968
aria2c.exe
Potential Corporate Privacy Violation
GPL P2P BitTorrent transfer
968
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
968
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
968
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
968
aria2c.exe
Misc activity
INFO [ANY.RUN] P2P BitTorrent Protocol
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Medicat_Installer.bat