File name:

JRT_8.1.4.exe

Full analysis: https://app.any.run/tasks/cdcd4589-af0f-4a82-8240-5613c0ad3957
Verdict: Malicious activity
Analysis date: February 12, 2024, 23:57:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E40542C4CC75E658A4615BFEFB308570

SHA1:

961A8C8C332494201E4F275FE1F50ABAE99140B3

SHA256:

2000ACF98EF0AC1A2D75C91586B5F30A2BC3ECE6E92388B324614C93A0645CF5

SSDEEP:

98304:ofPy7aaBPMFofjtZ7dvirsNhwx5SWAxVILeVnW7Hlr8AKpG7l6I3keTo7HUlmn1m:Agd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • JRT_8.1.4.exe (PID: 3772)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • JRT_8.1.4.exe (PID: 3772)

    • Reads the Internet Settings

      • JRT_8.1.4.exe (PID: 3772)

    • Executing commands from a ".bat" file

      • JRT_8.1.4.exe (PID: 3772)

    • Executable content was dropped or overwritten

      • JRT_8.1.4.exe (PID: 3772)

    • Starts CMD.EXE for commands execution

      • JRT_8.1.4.exe (PID: 3772)
      • cmd.exe (PID: 2848)

    • The executable file from the user directory is run by the CMD process

      • WGET.DAT (PID: 2856)
      • CreateRestorePoint.exe (PID: 2896)
      • GREP.DAT (PID: 3404)
      • SED.DAT (PID: 2248)
      • GREP.DAT (PID: 992)
      • GREP.DAT (PID: 1840)
      • GREP.DAT (PID: 2052)
      • GREP.DAT (PID: 920)
      • GREP.DAT (PID: 3272)
      • GREP.DAT (PID: 1124)
      • GREP.DAT (PID: 1020)
      • GREP.DAT (PID: 2956)
      • GREP.DAT (PID: 1820)
      • GREP.DAT (PID: 1636)
      • SED.DAT (PID: 2584)
      • SORT_.DAT (PID: 1216)
      • GREP.DAT (PID: 2828)
      • GREP.DAT (PID: 1736)
      • GREP.DAT (PID: 1652)
      • SED.DAT (PID: 2736)
      • GREP.DAT (PID: 584)
      • GREP.DAT (PID: 3456)
      • GREP.DAT (PID: 3808)
      • GREP.DAT (PID: 2492)
      • GREP.DAT (PID: 2740)
      • GREP.DAT (PID: 2228)
      • GREP.DAT (PID: 3044)
      • GREP.DAT (PID: 3440)
      • GREP.DAT (PID: 3860)
      • GREP.DAT (PID: 4036)
      • GREP.DAT (PID: 1196)
      • GREP.DAT (PID: 3548)
      • GREP.DAT (PID: 3748)
      • GREP.DAT (PID: 3452)
      • GREP.DAT (PID: 3364)
      • GREP.DAT (PID: 3268)
      • GREP.DAT (PID: 2996)
      • GREP.DAT (PID: 4016)
      • GREP.DAT (PID: 2044)
      • GREP.DAT (PID: 3284)
      • GREP.DAT (PID: 3660)
      • GREP.DAT (PID: 2328)
      • GREP.DAT (PID: 864)
      • GREP.DAT (PID: 3500)
      • GREP.DAT (PID: 2860)
      • GREP.DAT (PID: 1696)
      • GREP.DAT (PID: 2692)
      • GREP.DAT (PID: 1388)
      • GREP.DAT (PID: 4044)
      • GREP.DAT (PID: 1432)
      • GREP.DAT (PID: 2072)
      • GREP.DAT (PID: 1860)

    • Application launched itself

      • cmd.exe (PID: 2848)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2848)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3180)

    • Searches for installed software

      • CreateRestorePoint.exe (PID: 2896)

    • Get information on the list of running processes

      • cmd.exe (PID: 2848)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2848)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2848)

  • INFO

    • Checks supported languages

      • JRT_8.1.4.exe (PID: 3772)
      • WGET.DAT (PID: 2856)
      • CreateRestorePoint.exe (PID: 2896)
      • SED.DAT (PID: 2248)
      • GREP.DAT (PID: 3404)
      • GREP.DAT (PID: 1840)
      • GREP.DAT (PID: 992)
      • GREP.DAT (PID: 2052)
      • SORT_.DAT (PID: 1216)
      • GREP.DAT (PID: 2956)
      • GREP.DAT (PID: 1124)
      • GREP.DAT (PID: 3272)
      • GREP.DAT (PID: 1820)
      • GREP.DAT (PID: 1636)
      • SED.DAT (PID: 2584)
      • GREP.DAT (PID: 920)
      • GREP.DAT (PID: 1020)
      • GREP.DAT (PID: 2828)
      • GREP.DAT (PID: 1736)

    • Reads the computer name

      • JRT_8.1.4.exe (PID: 3772)
      • WGET.DAT (PID: 2856)
      • CreateRestorePoint.exe (PID: 2896)

    • Create files in a temporary directory

      • JRT_8.1.4.exe (PID: 3772)

    • Reads the machine GUID from the registry

      • WGET.DAT (PID: 2856)
      • CreateRestorePoint.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:27 07:06:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 70656
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0x11def
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.1.4.0
ProductVersionNumber: 8.1.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Junkware Removal Tool
FileVersion: 8.1.4
ProductVersion: 8.1.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
133
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start jrt_8.1.4.exe cmd.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs find.exe no specs net1.exe no specs net.exe no specs ping.exe no specs wget.dat fc.exe no specs createrestorepoint.exe no specs vssvc.exe no specs SPPSurrogate no specs tasklist.exe no specs grep.dat findstr.exe no specs sed.dat no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs findstr.exe no specs fc.exe no specs findstr.exe no specs fc.exe no specs reg.exe no specs grep.dat grep.dat reg.exe no specs reg.exe no specs grep.dat grep.dat reg.exe no specs fc.exe no specs sed.dat no specs sort_.dat no specs grep.dat no specs grep.dat no specs fc.exe no specs findstr.exe no specs fc.exe no specs grep.dat no specs grep.dat no specs grep.dat no specs fc.exe no specs find.exe no specs cmd.exe no specs findstr.exe no specs fc.exe no specs grep.dat no specs grep.dat no specs grep.dat no specs fc.exe no specs reg.exe no specs grep.dat sed.dat no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs find.exe no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs grep.dat no specs grep.dat fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs fc.exe no specs grep.dat no specs fc.exe no specs reg.exe no specs reg.exe no specs grep.dat grep.dat reg.exe no specs grep.dat reg.exe no specs grep.dat reg.exe no specs grep.dat reg.exe no specs grep.dat reg.exe no specs grep.dat reg.exe no specs reg.exe no specs grep.dat grep.dat reg.exe no specs cmd.exe no specs find.exe no specs fc.exe no specs fc.exe no specs fc.exe no specs grep.dat no specs fc.exe no specs grep.dat no specs fc.exe no specs jrt_8.1.4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120C:\Windows\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
124FC "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\LOGON" "C:\Users\admin\AppData\Local\Temp\jrt\null" C:\Windows\System32\fc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS 5 File Compare Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\fc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
128FC "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\APPINIT_T" "C:\Users\admin\AppData\Local\Temp\jrt\null" C:\Windows\System32\fc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS 5 File Compare Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\fc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
296FINDSTR /IG:"C:\Users\admin\AppData\Local\Temp\jrt\bl_appinit.cfg" "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\APPINIT2" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
448FINDSTR /V "REG.EXE REG_MULTI_SZ" "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\APPINIT" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
584"C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT" -i -v -x -f "C:\Users\admin\AppData\Local\Temp\jrt\wl_services.cfg" "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\SERVICES2"C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT—cmd.exe
User:
admin
Company:
GnuWin32 <http://gnuwin32.sourceforge.net>
Integrity Level:
HIGH
Description:
Grep: print lines matching a pattern
Exit code:
0
Version:
2.5.4.3331
Modules
Images
c:\users\admin\appdata\local\temp\jrt\grep.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\jrt\libintl3.dll
c:\users\admin\appdata\local\temp\jrt\libiconv2.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668FIND "x64" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680TASKLIST /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
864"C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT" -q "0.7A64656E67696E65.0"C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT
cmd.exe
User:
admin
Company:
GnuWin32 <http://gnuwin32.sourceforge.net>
Integrity Level:
HIGH
Description:
Grep: print lines matching a pattern
Exit code:
1
Version:
2.5.4.3331
Modules
Images
c:\users\admin\appdata\local\temp\jrt\grep.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\jrt\libintl3.dll
c:\users\admin\appdata\local\temp\jrt\libiconv2.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
920"C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT" -i -P "^\w+_\w{2} browser plugin (?:loader|loader 64)$|^\w+ search scope monitor$|^\w+ EPM Support$|^\w+ AppIntegrator (?:32|64)-bit$|^ConduitFloatingPlugin_.*|^GoogleChromeAutoLaunch_.*|^SaferAutoLaunch_.*|^shopperz\d{5,}$|^groover\d{5,}$|^firstOffer\d{5,}$|^[a-z]{3,6}_[a-z]{2}_\d{2,9}$|^tmp[0-9A-F]{4}$|^updater\d{5}$|^[0-9a-f]{32}$|^\d{8}$|^[a-z]{1}utoauto$|^ ?maintance$|^ ?qqpctray$|^sun\d{1}$|^SimpleNoteApp\d{1,}$|^Advanced PC-?\s*(?:Fixer|Care).*" "C:\Users\admin\AppData\Local\Temp\jrt\TEMP\LOGON" C:\Users\admin\AppData\Local\Temp\jrt\GREP.DAT—cmd.exe
User:
admin
Company:
GnuWin32 <http://gnuwin32.sourceforge.net>
Integrity Level:
HIGH
Description:
Grep: print lines matching a pattern
Exit code:
1
Version:
2.5.4.3331
Modules
Images
c:\users\admin\appdata\local\temp\jrt\grep.dat
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\jrt\libintl3.dll
c:\users\admin\appdata\local\temp\jrt\libiconv2.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
32 116
Read events
31 956
Write events
160
Delete events
0

Modification events

(PID) Process:(3772) JRT_8.1.4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3772) JRT_8.1.4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3772) JRT_8.1.4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3772) JRT_8.1.4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2896) CreateRestorePoint.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000E40981510F5EDA01500B00005C0B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2896) CreateRestorePoint.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000E40981510F5EDA01500B00005C0B0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2896) CreateRestorePoint.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(2896) CreateRestorePoint.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000005ABA91510F5EDA01500B00005C0B0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2896) CreateRestorePoint.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000000E7F96510F5EDA01500B00003C090000E80300000100000000000000000000001798488ECC204A41BEF5BAA03C4497A80000000000000000
(PID) Process:(3180) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000001CA69D510F5EDA016C0C0000D8050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
13
Suspicious files
1
Text files
57
Unknown types
3

Dropped files

PID
Process
Filename
Type
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\nfo\NirCmd.chmchm
MD5:66729EFE2819E71C060AF7FD49732C28
SHA256:E050308C4A297F637A848109D719C65A62F6AB6ED0D854D026CC2DF257515D32
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_ffplugin.cfgtext
MD5:6C0A5B19478B5CC273E9DE5C2AA0E165
SHA256:691E2F088E116FF729CF64535C2FE4389D0000A7DA8D4FBF1DA4C7CBD6D451F8
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_ffxml.cfgtext
MD5:CDEF3ABCAE8AD1B6B6CAAFC7BA8C5D73
SHA256:DE626B2E02DB7539121A83BA38F760A875F124D9C3DD05CCC7BBC589F298B00A
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_foldersM.cfgtext
MD5:05E5ADB8B23A6E536DF993C489A50E4E
SHA256:8713DDF34AC396A003C6AF549979D5133956F4A296E8389BDAC205B49B2841F4
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_chrstrg.cfgtext
MD5:EBDFDE9F11720DFC627933F37E8AE319
SHA256:613DEC5AE47C9FCC4EFF4E50FE811FD41A9442796A57DBB0E63FBE36178C0663
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_lnkurls.cfgtext
MD5:74A83514DF51A7E8CA94A9376A5E2F79
SHA256:2D7E65B84AF88A378BF968CC7766E25CA8957847CD265F5E0050FB67B141A968
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_foldersC.cfgtext
MD5:AE4C96D8F463036C8EFEA6A0565C2F50
SHA256:69EB2C63BAB14F7E91CA4483E741583D8F6B8994F79C53FDF17CE6AF7774738F
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_lnkfiles.cfgtext
MD5:F28FF60EDEC9DA7F2691AE8F012961C6
SHA256:F88515A3A4AB36C42A681AD0BA14E8F5B8EF8278399FC173AC240720799443BA
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_services.cfgtext
MD5:57E41FCC47169A978C4B789420F21267
SHA256:480D7AD39761E3BB57C8FE60531D19301D50A36F23E4ACA1302B35D53590DF73
3772JRT_8.1.4.exeC:\Users\admin\AppData\Local\Temp\jrt\bl_foldersS.cfgtext
MD5:97B7FD68B9E6CC1194A000FF783EAAF7
SHA256:6767C800257E09AC3CC886F1E5CAD05AB9E6144CB08B28B385AE07EB62AE1A1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2856
WGET.DAT
GET
301
65.9.66.107:80
http://data-cdn.mbamupdates.com/v1/tools/jrt/jrtnewmd5
unknown
html
167 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2856
WGET.DAT
65.9.66.107:80
data-cdn.mbamupdates.com
AMAZON-02
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2856
WGET.DAT
65.9.66.107:443
data-cdn.mbamupdates.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.36
whitelisted
data-cdn.mbamupdates.com
  • 65.9.66.107
  • 65.9.66.85
  • 65.9.66.47
  • 65.9.66.84
whitelisted

Threats

No threats detected
Process
Message
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
GREP.DAT
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
JRT_8.1.4.exe