File name:

smb.ps1

Full analysis: https://app.any.run/tasks/eec7ec7c-fa9a-45e2-a592-35021d47b4aa
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 06:43:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto
coinminer
sliver
xmrig
golang
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (1130)
MD5:

687BB8495D9ECA73A769310DB64FA037

SHA1:

2498B1A89402D8F3D82BE845F517F0E95D20F43B

SHA256:

0B9FABC7B01FA16A48CC2944046B62D11B0067F5CB3D8B0985590C5C67BF78A0

SSDEEP:

192:PPgwDU+sP6/3sYORryq4KoUGlkUyEcLv2:PPge/34z3C

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2100)

    • COINMINER has been found (auto)

      • powershell.exe (PID: 2100)

    • XMRig has been detected

      • wininiti.exe (PID: 7788)

    • XMRIG has been detected (YARA)

      • wininiti.exe (PID: 7788)

    • Antivirus name has been found in the command line (generic signature)

      • tasklist.exe (PID: 4464)
      • tasklist.exe (PID: 5528)
      • tasklist.exe (PID: 4628)
      • tasklist.exe (PID: 5600)
      • tasklist.exe (PID: 6112)
      • tasklist.exe (PID: 5352)
      • tasklist.exe (PID: 7508)
      • tasklist.exe (PID: 7480)
      • tasklist.exe (PID: 1512)
      • tasklist.exe (PID: 7840)
      • tasklist.exe (PID: 496)
      • tasklist.exe (PID: 5576)
      • tasklist.exe (PID: 6192)
      • tasklist.exe (PID: 5548)
      • tasklist.exe (PID: 1128)
      • tasklist.exe (PID: 1388)
      • tasklist.exe (PID: 5436)
      • tasklist.exe (PID: 5228)
      • tasklist.exe (PID: 3900)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2100)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 2100)

    • Connects to unusual port

      • wininiti.exe (PID: 7788)
      • powershell.exe (PID: 2100)

    • Get information on the list of running processes

      • rundll39.exe (PID: 7876)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 2100)

    • Checks supported languages

      • rundll39.exe (PID: 7876)
      • wininiti.exe (PID: 7788)

    • The executable file from the user directory is run by the Powershell process

      • wininiti.exe (PID: 7788)
      • rundll39.exe (PID: 7876)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • rundll39.exe (PID: 7876)

    • Checks proxy server information

      • powershell.exe (PID: 2100)

    • Reads the computer name

      • wininiti.exe (PID: 7788)

    • Application based on Golang

      • rundll39.exe (PID: 7876)

    • Detects GO elliptic curve encryption (YARA)

      • rundll39.exe (PID: 7876)

    • Reads the software policy settings

      • slui.exe (PID: 7280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
242
Monitored processes
112
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #COINMINER powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe #XMRIG wininiti.exe rundll39.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs slui.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs tasklist.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208tasklist /FI "IMAGENAME eq nuPerfScan.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
496tasklist /FI "IMAGENAME eq ashServ.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
632tasklist /FI "IMAGENAME eq ncolow.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
668tasklist /FI "IMAGENAME eq RuleUp.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
864tasklist /FI "IMAGENAME eq wsc_proxy.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
920tasklist /FI "IMAGENAME eq aswupdsv.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
968tasklist /FI "IMAGENAME eq wa_3rd_party_host_32.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1072tasklist /FI "IMAGENAME eq WSCStub.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1128tasklist /FI "IMAGENAME eq MCSHELL.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1324tasklist /FI "IMAGENAME eq AvastSvc.exe"C:\Windows\System32\tasklist.exe—rundll39.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
15 282
Read events
15 282
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2N0IKH75KJ7A2S122LMB.tempbinary
MD5:9ECF708645BFB2C28168DD6C2D9C469A
SHA256:A14C71C78A5078BBD1E57A1CE7C006555A6E6C2B0A14C647E13C5584FB579101
2100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Hidden\system32\rundll39.exeexecutable
MD5:A7D826BF33220F0F9DA9357416FF27CA
SHA256:C188E86F54843FC6F187D63A9C1F9327D1FFF8167A9D5404661E1A6B78E3824F
2100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Hidden\system32\wininiti.exeexecutable
MD5:E6D556B999FF69F3BA4165053429ADF3
SHA256:9D51B34A2EF488E96D948B090963D78F7EE375DC1F4723E51CE3D5C26801DCFB
2100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:C904B83F3EB6B36C24B175843EAE2F18
SHA256:AE9C3B418FC314078AEA3B8FE77670BDBD72E127D1DAE886D031A73C2074B64F
2100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:835E04FCCA6A3112D4847165B494B8C1
SHA256:1ABF4C95ED0E458962BB3FA56339A4DA6272FC66066DC7E134A40B9C22A9BBCD
2100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uhzpcbey.t44.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mrujmn2h.kjs.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b335.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
2100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:9ECF708645BFB2C28168DD6C2D9C469A
SHA256:A14C71C78A5078BBD1E57A1CE7C006555A6E6C2B0A14C647E13C5584FB579101
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
24
DNS requests
16
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2100
powershell.exe
GET
200
107.173.154.7:9999
http://107.173.154.7:9999/installer/wininiti
unknown
—
—
unknown
2100
powershell.exe
GET
200
107.173.154.7:9999
http://107.173.154.7:9999/installer/rundll39
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7200
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7200
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2100
powershell.exe
107.173.154.7:9999
—
AS-COLOCROSSING
US
unknown
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.128
  • 20.190.159.2
  • 40.126.31.129
  • 20.190.159.68
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2100
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2100
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download
2100
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2100
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
smb.ps1