File name:

Roblx Cheats .exe

Full analysis: https://app.any.run/tasks/4c83f6e0-e983-4231-8f6c-8d1353ae89bd
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 10:02:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

82D5D2D666446A7DF24D9824AF9884B8

SHA1:

1BEF21FC971110F52AE801DDDE2EBC27A50A60A7

SHA256:

0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345

SSDEEP:

384:7GaqtREU9twsodxOvC4XeK99KjGn2pssIJqqah0I8ZumTG3IBL+EcoinblneHQM+:UtREWmOvbXe8IGnLJqqiD8ZuSNuzfcI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Roblx Cheats .exe (PID: 564)

    • Create files in the Startup directory

      • Roblx Cheats .exe (PID: 564)

    • NJRAT has been detected (YARA)

      • Roblx Cheats .exe (PID: 564)

    • Changes the autorun value in the registry

      • Roblx Cheats .exe (PID: 564)

    • NjRAT is detected

      • Roblx Cheats .exe (PID: 564)

    • Connects to the CnC server

      • Roblx Cheats .exe (PID: 564)

    • NJRAT has been detected (SURICATA)

      • Roblx Cheats .exe (PID: 564)

  • SUSPICIOUS

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Roblx Cheats .exe (PID: 564)

    • Connects to unusual port

      • Roblx Cheats .exe (PID: 564)

    • Process drops legitimate windows executable

      • chrome.exe (PID: 4080)

  • INFO

    • Checks supported languages

      • Roblx Cheats .exe (PID: 564)
      • wmpnscfg.exe (PID: 2632)

    • Reads the computer name

      • Roblx Cheats .exe (PID: 564)
      • wmpnscfg.exe (PID: 2632)

    • Creates files or folders in the user directory

      • Roblx Cheats .exe (PID: 564)

    • Reads the machine GUID from the registry

      • Roblx Cheats .exe (PID: 564)

    • Reads Environment values

      • Roblx Cheats .exe (PID: 564)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2632)
      • WINWORD.EXE (PID: 2908)
      • WINWORD.EXE (PID: 1936)
      • WINWORD.EXE (PID: 644)
      • chrome.exe (PID: 4080)
      • chrome.exe (PID: 2460)

    • Drops the executable file immediately after the start

      • chrome.exe (PID: 4080)

    • Application launched itself

      • chrome.exe (PID: 4080)
      • chrome.exe (PID: 2460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(564) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:02 09:31:07+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 35840
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0xabbe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
43
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT roblx cheats .exe netsh.exe no specs wmpnscfg.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1124 --field-trial-handle=1224,i,167576676976616838,866062409550635706,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
564"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\roblx cheats .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(564) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
644"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\collegerange.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
644"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3552 --field-trial-handle=1224,i,167576676976616838,866062409550635706,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
924"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3612 --field-trial-handle=1224,i,167576676976616838,866062409550635706,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3584 --field-trial-handle=1136,i,11164949116436817295,15564828100209237882,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2100 --field-trial-handle=1224,i,167576676976616838,866062409550635706,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1160"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2784 --field-trial-handle=1224,i,167576676976616838,866062409550635706,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1236netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" "Roblx Cheats .exe" ENABLEC:\Windows\System32\netsh.exe—Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3452 --field-trial-handle=1136,i,11164949116436817295,15564828100209237882,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
12 395
Read events
11 218
Write events
739
Delete events
438

Modification events

(PID) Process:(1236) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(564) Roblx Cheats .exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:73fcd7a7907fbbeafe1fb23fee56d70d
Value:
"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" ..
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(2908) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
Executable files
3
Suspicious files
173
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
2908WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE9E7.tmp.cvr —
MD5:—
SHA256:—
1936WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR7CF.tmp.cvr —
MD5:—
SHA256:—
644WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR28D4.tmp.cvr —
MD5:—
SHA256:—
2908WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8F757C56-2DE9-4780-B3E0-D73C2D47A36D}.tmpbinary
MD5:A643CBAFC9C18E555DC35AAB56C0497D
SHA256:8F603C2D47B148B08D4005ED4BA1D02C93891BA06650C95D32BB65187411C1F8
2908WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\zealandmethod.rtf.LNKbinary
MD5:6E4ECC6B40DE6DA84D4E633F78B1B67F
SHA256:FBF6157C01C07B4F05D00F8753974647DAB0CD57784A4C64152986FBAB18F95D
564Roblx Cheats .exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\73fcd7a7907fbbeafe1fb23fee56d70d.exeexecutable
MD5:82D5D2D666446A7DF24D9824AF9884B8
SHA256:0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345
2908WINWORD.EXEC:\Users\admin\Desktop\~$alandmethod.rtfbinary
MD5:3F23808EAEAF2303829E29000D12A379
SHA256:BA8FBF97C12DECCA1BE61D72FC106DBC0286DDA3DCE135264BF7A3B6F78BF0C3
1936WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:8B10546A5C41AB1AA46A0B42667AA613
SHA256:DC9E389494B4AFD6CE9116E97D5B1B3E456E180E93AA6A9B8E5C2D35ACDFEE03
4080chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF222824.TMP —
MD5:—
SHA256:—
2908WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{2070E4E0-3786-4292-9C87-6518F92D172F}.tmpbinary
MD5:40BE91E5208CFF4146DE4DA11F701F8F
SHA256:A67F3B8AC37B3A81B64A4C66752924B45C8C5E571524AA6E396E5AEA4C8E4FB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
50
DNS requests
57
Threats
192

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
svchost.exe
23.35.228.137:80
—
AKAMAI-AS
DE
unknown
564
Roblx Cheats .exe
45.153.230.56:25264
—
MIRholding B.V.
DE
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
88.221.168.141:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3500
chrome.exe
108.177.15.84:443
accounts.google.com
GOOGLE
US
unknown
4080
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
3500
chrome.exe
142.250.181.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
3500
chrome.exe
172.217.18.100:443
www.google.com
GOOGLE
US
whitelisted
3500
chrome.exe
142.250.185.67:443
www.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 88.221.168.141
whitelisted
accounts.google.com
  • 108.177.15.84
shared
clientservices.googleapis.com
  • 142.250.181.227
whitelisted
www.google.com
  • 172.217.18.100
whitelisted
www.gstatic.com
  • 142.250.185.67
whitelisted
apis.google.com
  • 142.250.185.110
  • 216.58.212.142
whitelisted
update.googleapis.com
  • 142.250.186.131
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.185.174
whitelisted
fonts.gstatic.com
  • 142.250.186.67
whitelisted
ijavhd-com.webpkgcache.com
  • 142.250.186.161
unknown

Threats

PID
Process
Class
Message
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
564
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblx Cheats .exe