File name:

789572307cac2c8c4160180f120529b44458c63b9c50cec03f7fba5da61774c2.rar

Full analysis: https://app.any.run/tasks/cf6e3f05-9089-4459-9e46-b9cff46c2cc4
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: October 03, 2025, 18:03:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
snake
keylogger
evasion
stealer
susp-powershell
api-base64
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

D0E297AE82C59070886E7B6FCFFD950A

SHA1:

ABF7A8B7EFEE8A889A769B6A6146C824AD7AC6E3

SHA256:

789572307CAC2C8C4160180F120529B44458C63B9C50CEC03F7FBA5DA61774C2

SSDEEP:

12288:gom+N0IAjtpV/Udnr0leS+S3KI7Iq9JOU2Ow5/Lr5QH:Tm+N0IgtpV/UZr0gS+mj7Iq939w5//uH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 8004)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 7804)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 7804)

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 7804)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 7804)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6772)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 7804)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6772)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6772)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • aspnet_compiler.exe (PID: 6240)

    • Actions looks like stealing of personal data

      • aspnet_compiler.exe (PID: 6240)

    • Steals credentials from Web Browsers

      • aspnet_compiler.exe (PID: 6240)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7804)

    • Accesses computer name via WMI (SCRIPT)

      • wscript.exe (PID: 7804)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 7804)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 7804)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7804)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7804)

    • Changes charset (SCRIPT)

      • wscript.exe (PID: 7804)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 7804)

    • Access the System.Security .NET namespace (SCRIPT)

      • wscript.exe (PID: 7804)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 7804)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7804)

    • The process executes Powershell scripts

      • wscript.exe (PID: 7804)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Checks for external IP

      • svchost.exe (PID: 2428)
      • aspnet_compiler.exe (PID: 6240)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 7804)

    • The process verifies whether the antivirus software is installed

      • aspnet_compiler.exe (PID: 6240)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 7804)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6772)

    • Reads the software policy settings

      • aspnet_compiler.exe (PID: 6240)
      • slui.exe (PID: 8736)

    • Reads the computer name

      • aspnet_compiler.exe (PID: 6240)

    • Checks supported languages

      • aspnet_compiler.exe (PID: 6240)

    • Reads the machine GUID from the registry

      • aspnet_compiler.exe (PID: 6240)

    • Disables trace logs

      • aspnet_compiler.exe (PID: 6240)

    • Checks proxy server information

      • aspnet_compiler.exe (PID: 6240)
      • slui.exe (PID: 8736)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • wscript.exe (PID: 7804)

    • Potential remote process memory interaction (Base64 Encoded 'VirtualAllocEx')

      • powershell.exe (PID: 6772)

    • Potential remote process memory reading (Base64 Encoded 'ReadProcessMemory')

      • powershell.exe (PID: 6772)

    • Potential modification of remote process state (Base64 Encoded 'SetThreadContext')

      • powershell.exe (PID: 6772)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • powershell.exe (PID: 6772)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • powershell.exe (PID: 6772)

    • Found Base64 encoded encryption-related PowerShell classes (YARA)

      • wscript.exe (PID: 7804)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • powershell.exe (PID: 6772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

FileVersion: RAR v4
CompressedSize: 381178
UncompressedSize: 554210
OperatingSystem: Win32
ModifyDate: 2025:10:03 02:22:52
PackingMethod: Normal
ArchivedFileName: llty643.VBE
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
178
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs #SNAKEKEYLOGGER aspnet_compiler.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2288"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2368"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2836"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3060"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4068"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6240"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6772"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\XNEU1SLKBYEC_6.503592E+07.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
7804"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\Desktop\llty643.VBEC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 307
Read events
16 274
Write events
33
Delete events
0

Modification events

(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\789572307cac2c8c4160180f120529b44458c63b9c50cec03f7fba5da61774c2.rar
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7804wscript.exeC:\Temp\XNEU1SLKBYEC_6.503592E+07.ps1text
MD5:45DA421BE4BB5F5EFAC72FFEEE2880E8
SHA256:30400B8D3C68A476ADC1A8E5B90FA297B304D7A0DF5EBDC677A76C687A606304
6772powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_exczmxsq.4zz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6772powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gjngq0kp.5qv.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
46
DNS requests
18
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.192.36.137:443
https://www.bing.com/DSB/search?dsbmr=1&format=dsbjson&client=windowsminiserp&dsbschemaversion=1.1&dsbminiserp=1&q=q&cc=US&setlang=en-us&clientDateTime=10%2F3%2F2025%2C%206%3A04%3A01%20PM
US
binary
64.2 Kb
unknown
—
—
POST
204
23.192.36.137:443
https://www.bing.com/web/xlsc.aspx?t=5&dl=1&wsbc=1
US
—
—
unknown
—
—
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
US
xml
11.2 Kb
unknown
—
—
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
unknown
—
—
GET
200
23.192.36.137:443
https://www.bing.com/th?id=ODSWG.8229b0e5-fa8c-4e4a-af74-69717698b903&pid=dsb
US
—
4.62 Kb
unknown
—
—
POST
200
20.190.159.73:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
POST
200
40.126.31.3:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
US
xml
11.3 Kb
unknown
—
—
GET
200
23.192.36.142:443
https://www.bing.com/th?id=ODSWG.31bcf3d1-4df8-4c6a-9b3a-447ced8d6c39&pid=dsb
US
image
4.64 Kb
unknown
—
—
GET
200
23.192.36.137:443
https://www.bing.com/client/config?cc=US&setlang=en-US
US
binary
2.15 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6016
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3572
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.192.36.142:443
www.bing.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5948
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
23.192.36.137:443
www.bing.com
AKAMAI-AS
US
whitelisted
2404
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4676
backgroundTaskHost.exe
23.192.36.142:443
www.bing.com
AKAMAI-AS
US
whitelisted
3464
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
www.bing.com
  • 23.192.36.142
  • 23.192.36.137
whitelisted
google.com
  • 142.250.181.238
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.129
  • 20.190.159.64
  • 20.190.159.131
  • 20.190.159.73
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
checkip.dyndns.org
  • 132.226.8.169
  • 193.122.130.0
  • 158.101.44.242
  • 132.226.247.73
  • 193.122.6.168
whitelisted
reallyfreegeoip.org
  • 188.114.96.3
  • 188.114.97.3
malicious
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
www.microsoft.com
  • 23.57.80.253
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2428
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
6240
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6240
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2428
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
6240
aspnet_compiler.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
2428
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
6240
aspnet_compiler.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
789572307cac2c8c4160180f120529b44458c63b9c50cec03f7fba5da61774c2.rar