title: Is this code a Keylogger? What does it do?
body: <p>Due to Windows10 task manager I have a powershell.exe running which is continously consuming 8% CPU and blocking 64MB of RAM. After inspecting my Windows event log I found a pipeline event (800) with subsequent code:</p>
  <pre><code>Add-Type -AssemblyName System.Core
  function Run-Server() {
    param([string]$h);
    $b = New-Object byte[] 8;
    $p = New-Object System.IO.Pipes.AnonymousPipeClientStream -ArgumentList @([System.IO.Pipes.PipeDirection]::In, $h);
    if ($p) {
      $l = $p.Read($b, 0, 8); while ($l -gt 7) {
        $c = [System.BitConverter]::ToInt32($b, 0); $l = System.BitConverter]::ToInt32($b, 4);
        $t = $null; if ($l -gt 0) {
          $t1 = New-Object byte[] $l;
          $l = $p.Read($t1, 0, $t1.Length);
          $t = [System.Text.Encoding]::UTF8.GetString($t1, 0, $l) }
        if ($c -eq 1) { Invoke-Expression $t } elseif ($c -eq 9) { break } $l = $p.Read($b, 0, 8) } 
     $p.Dispose() 
      } 
  } Run-Server -h 728
  </code></pre>
  <p>I'm working in a corporate environment and I'm not a Powershell expert, but it seems as the script is catching byte by byte and make a string out of it? Do you have any idea what this script could be used for? Do you think it can cause the given indication of 8% CPU and 64MB RAM usage?</p>