File name:

carga_usuarios.ps1

Full analysis: https://app.any.run/tasks/56c755dd-8a1b-4639-9cee-44f2a3c4213b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 23, 2025, 06:12:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
arch-doc
ransomware
loader
arch-exec
arch-html
Indicators:
MIME: text/html
File info: HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
MD5:

CF4CA0CB2CA51953CD4CE14B2114AB26

SHA1:

2F0A351B3C694DF0E4F09AB850E3BCC136B3C227

SHA256:

99FF9B041959ADFE474BA71044CF62A1BA66533B456AF47E9AA2E631641CEE88

SSDEEP:

96:mkKy/2Ptmcer6rRD7sRYRUI0ds2Ns8YNGMGMGMGMGMGMGwd1z3FgU7M6GtT1:r/2TeCfUPaSaGMGMGMGMGMGMGwd1zVKT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1072)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 2656)

    • Detects Cygwin installation

      • powershell.exe (PID: 1072)

    • Renames files like ransomware

      • ccrypt.exe (PID: 1660)

    • Starts CertUtil for downloading files

      • powershell.exe (PID: 1072)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1072)
      • DefenderRemover.exe (PID: 6516)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1072)
      • DefenderRemover.exe (PID: 6516)

    • Executing commands from a ".bat" file

      • DefenderRemover.exe (PID: 6516)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ccrypt.exe (PID: 1660)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 1072)

  • INFO

    • Reads Windows Product ID

      • powershell.exe (PID: 1072)

    • Checks proxy server information

      • powershell.exe (PID: 1072)
      • certutil.exe (PID: 5244)
      • certutil.exe (PID: 4528)
      • certutil.exe (PID: 7012)

    • Disables trace logs

      • powershell.exe (PID: 1072)

    • The executable file from the user directory is run by the Powershell process

      • DefenderRemover.exe (PID: 5204)
      • DefenderRemover.exe (PID: 6516)
      • ccrypt.exe (PID: 1660)

    • The sample compiled with english language support

      • powershell.exe (PID: 1072)
      • DefenderRemover.exe (PID: 6516)

    • Reads the computer name

      • DefenderRemover.exe (PID: 6516)
      • ccrypt.exe (PID: 1660)
      • identity_helper.exe (PID: 8096)

    • Create files in a temporary directory

      • DefenderRemover.exe (PID: 6516)

    • Checks supported languages

      • DefenderRemover.exe (PID: 6516)
      • ccrypt.exe (PID: 1660)
      • identity_helper.exe (PID: 8096)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1072)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 1072)

    • Application launched itself

      • msedge.exe (PID: 6156)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1072)

    • Reads the software policy settings

      • slui.exe (PID: 6700)

    • Reads Environment values

      • identity_helper.exe (PID: 8096)

    • Reads security settings of Internet Explorer

      • certutil.exe (PID: 5244)
      • certutil.exe (PID: 4528)
      • certutil.exe (PID: 7012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-8 encoded (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
42
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe schtasks.exe no specs tiworker.exe no specs defenderremover.exe no specs defenderremover.exe cmd.exe no specs conhost.exe no specs choice.exe no specs ccrypt.exe no specs conhost.exe no specs certutil.exe conhost.exe no specs certutil.exe conhost.exe no specs certutil.exe conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668schtasks /create /tn "UpdateChecker" /tr "powershell.exe -ExecutionPolicy Bypass -File \"C:\Users\admin\AppData\Roaming\Install.ps1\"" /sc onlogon /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1072"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Roaming\carga_usuarios.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1388\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660"C:\Users\admin\Downloads\ccrypt\ccrypt-1.11.cygwin-x64\ccrypt.exe" -e C:/Users/admin/Desktop/*.* -K 1337Th3M0nkeyOg C:\Users\admin\Downloads\ccrypt\ccrypt-1.11.cygwin-x64\ccrypt.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\ccrypt\ccrypt-1.11.cygwin-x64\ccrypt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\downloads\ccrypt\ccrypt-1.11.cygwin-x64\cygwin1.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6520 --field-trial-handle=2356,i,12898473156960070046,9919526080941068424,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2656"C:\WINDOWS\system32\cmd.exe" /c "schtasks /create /tn "UpdateChecker" /tr "powershell.exe -ExecutionPolicy Bypass -File \"%APPDATA%\Install.ps1\"" /sc onlogon /f"C:\Windows\System32\cmd.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—certutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 551
Read events
21 535
Write events
16
Delete events
0

Modification events

(PID) Process:(1324) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31181737
(PID) Process:(1324) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
(PID) Process:(1660) ccrypt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Cygwin\Installations
Operation:writeName:e345acbd01a36f9d
Value:
\??\C:\Users\admin\Downloads\ccrypt
(PID) Process:(1072) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids
Operation:writeName:htmlfile
Value:
(PID) Process:(6156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6156) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
2E4179C75D942F00
(PID) Process:(6156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\131690
Operation:writeName:WindowTabManagerFileMappingId
Value:
{B43278ED-A752-4F21-AB9E-B1D39ECBBDC4}
(PID) Process:(6156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
Executable files
12
Suspicious files
80
Text files
51
Unknown types
1

Dropped files

PID
Process
Filename
Type
1072powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:61E0AF0944077C545CBE2CC1A2CBD8B8
SHA256:A40C8FB5A8CEEE6EF3D52F4C6967C1010C747A07287F25203AA932DA64D43EA4
6516DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSFF32.tmp\Remove_Defender\Output.regtext
MD5:8FEF3E73F3DA0CF6B5CB34DA20309236
SHA256:9DDB1443316F09391064D02668608E881C15E25DB9C6667418D086A8F234BD16
6516DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSFF32.tmp\Script_Run.battext
MD5:44104C19893590DE7BBC2A2CBBA9B6E7
SHA256:32AD97E2B83D1EB8B49C2E54ED30C22E36DC21933CA6BAC3F66635868AAAA7CB
1072powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oc1felwm.fdr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1324TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:F9911840402342C6F9022CC6C992866F
SHA256:C02CBA8CEE974D192DB49F7FACA421E1359A0BED4D0760239A79030D73525CD4
6516DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSFF32.tmp\Remove_SecurityComp\Remove_SecurityComp.regtext
MD5:3B9A9024F8959120754A6BEFAF12E4BD
SHA256:C717111084EC331D2D5476D86ED098F5ACF939ECD6A15EFDEB5214FC2F6CF674
6516DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSFF32.tmp\Remove_Defender\RemoveShellAssociation.regtext
MD5:96038D8247EB77B6E8CAFA633B49521D
SHA256:778AA04D6A9395D77E16AB8B3D20B97ED459E4E06D87A051AB33DD3F090901E8
1072powershell.exeC:\Users\admin\Downloads\DefenderRemover.exeexecutable
MD5:29DF6172DA4B804F803E8987F6DF4CEA
SHA256:7D5785C1760909AC5DC68CE57AABCF86AF2444AE42E19B568EB1E32D8A414913
1072powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ijfpce5g.wpp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1072powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b98e.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
48
DNS requests
39
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3008
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3008
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
—
—
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.14
  • 20.190.160.67
  • 20.190.160.20
  • 20.190.160.5
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.111.133
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
carga_usuarios.ps1