File name:

ENCRYPT.Ps1

Full analysis: https://app.any.run/tasks/631b1b59-c2d2-4848-9d4d-8ffb363f581a
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: March 05, 2026, 12:18:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
snake
keylogger
telegram
spyware
stealer
netreactor
ims-api
generic
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, LF line terminators
MD5:

CBFB199CA7E05A2AB9F3AC5BBFF721B8

SHA1:

47E78B85FE4AFDA0EE3C59CB403C04847EC33C65

SHA256:

36C76683F75B9669A0ED83328602E9A925AC7D7367ACD628A1F23A92FC31799A

SSDEEP:

12288:JBwIfm/WQBwp8thZYpfQO70si9hgQMZITBYVNHSCprd8n/I:W3wAIfvVhmg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Steals credentials from Web Browsers

      • aspnet_compiler.exe (PID: 7464)
    • SNAKE has been detected (SURICATA)

      • aspnet_compiler.exe (PID: 7464)
    • Actions looks like stealing of personal data

      • aspnet_compiler.exe (PID: 7464)
    • SNAKE has been detected (YARA)

      • aspnet_compiler.exe (PID: 7464)
    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 8504)
  • SUSPICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8504)
    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 8504)
    • Checks for external IP

      • svchost.exe (PID: 2292)
      • aspnet_compiler.exe (PID: 7464)
    • Possible stealing of FTP data

      • aspnet_compiler.exe (PID: 7464)
    • The process verifies whether the antivirus software is installed

      • aspnet_compiler.exe (PID: 7464)
    • Possible stealing from browsers

      • aspnet_compiler.exe (PID: 7464)
    • Possible stealing of messenger data

      • aspnet_compiler.exe (PID: 7464)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • aspnet_compiler.exe (PID: 7464)
    • The process executes Powershell scripts

      • powershell.exe (PID: 8504)
    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 8504)
    • Possible stealing of email data

      • aspnet_compiler.exe (PID: 7464)
  • INFO

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 8504)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8504)
    • Reads the computer name

      • aspnet_compiler.exe (PID: 7464)
    • Reads the machine GUID from the registry

      • aspnet_compiler.exe (PID: 7464)
    • Checks proxy server information

      • aspnet_compiler.exe (PID: 7464)
      • slui.exe (PID: 6300)
    • .NET Reactor protector has been detected

      • powershell.exe (PID: 8504)
    • Checks supported languages

      • aspnet_compiler.exe (PID: 7464)
    • Disables trace logs

      • aspnet_compiler.exe (PID: 7464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(7464) aspnet_compiler.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Usermyreports@leedelectronics.top
SMTP Password7213575aceACE@@#
SMTP Hosthosting2.ro.hostsailor.com
SMTP SendTomyreport@leedelectronics.top
SMTP Port587
Telegram Bot Token8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA
Telegram Chat ID6337180137
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs #SNAKE aspnet_compiler.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2292C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6300C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7464"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
SnakeKeylogger
(PID) Process(7464) aspnet_compiler.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Usermyreports@leedelectronics.top
SMTP Password7213575aceACE@@#
SMTP Hosthosting2.ro.hostsailor.com
SMTP SendTomyreport@leedelectronics.top
SMTP Port587
Telegram Bot Token8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA
Telegram Chat ID6337180137
7660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8504"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\ENCRYPT.Ps1.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 325
Read events
12 311
Write events
14
Delete events
0

Modification events

(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7464) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Aspnet_compiler_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
8504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1e605e.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
8504powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_iuvmxuam.zfx.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8504powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_irzs2grz.3td.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8504powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:B01D4BC09B6EF2732439AE5BE07F411B
SHA256:D9F4E3E4D4F5E910D1518E22B3275FB741C495C5C5DC9867D68B51E07296DEAD
8504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:CC9667B1E1C22E1768ED4D69516AE61A
SHA256:DAD4207D1051A14333223076E5836E00E6FB97D79467961EEBAB5438F487EDC6
8504powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMX0DWRHATING72GZG6R.tempbinary
MD5:CC9667B1E1C22E1768ED4D69516AE61A
SHA256:DAD4207D1051A14333223076E5836E00E6FB97D79467961EEBAB5438F487EDC6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
60
DNS requests
29
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2328
RUXIMICS.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7004
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7004
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7464
aspnet_compiler.exe
GET
200
188.114.97.3:443
https://reallyfreegeoip.org/xml/145.40.144.40
US
binary
359 b
unknown
7464
aspnet_compiler.exe
GET
200
188.114.97.3:443
https://reallyfreegeoip.org/xml/145.40.144.40
US
359 b
unknown
GET
200
188.114.96.3:443
https://reallyfreegeoip.org/xml/145.40.144.40
US
binary
359 b
unknown
6768
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7464
aspnet_compiler.exe
GET
200
193.122.6.168:80
http://checkip.dyndns.org/
US
html
105 b
unknown
7464
aspnet_compiler.exe
GET
200
188.114.97.3:443
https://reallyfreegeoip.org/xml/145.40.144.40
US
359 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
Not routed
whitelisted
7004
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2328
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
92.123.104.14:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
92.123.104.61:443
th.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
Not routed
whitelisted
7004
svchost.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2328
RUXIMICS.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.14
  • 92.123.104.21
  • 92.123.104.19
  • 92.123.104.16
  • 92.123.104.18
  • 92.123.104.13
  • 92.123.104.20
  • 92.123.104.17
  • 92.123.104.22
whitelisted
th.bing.com
  • 92.123.104.61
  • 92.123.104.58
  • 92.123.104.66
  • 92.123.104.56
  • 92.123.104.59
  • 92.123.104.63
  • 92.123.104.65
  • 92.123.104.62
  • 92.123.104.55
whitelisted
self.events.data.microsoft.com
  • 20.189.173.14
  • 20.42.73.31
whitelisted
google.com
  • 172.217.16.174
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
checkip.dyndns.org
  • 193.122.6.168
  • 132.226.247.73
  • 193.122.130.0
  • 132.226.8.169
  • 158.101.44.242
whitelisted
reallyfreegeoip.org
  • 188.114.97.3
  • 188.114.96.3
shared
api.telegram.org
  • 149.154.166.110
whitelisted

Threats

PID
Process
Class
Message
2292
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2292
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
7464
aspnet_compiler.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
2292
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
7464
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
No debug info