File name:

NjRat Builder.7z

Full analysis: https://app.any.run/tasks/9ed9de7f-4dfe-4f25-b02b-b77a01b029e0
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 29, 2023, 12:36:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
securityxploded
rat
njrat
bladabindi
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

B80CD3589E08AB120E4CADED272EDCD9

SHA1:

C288255C0E171476974D26D53B508B13710672C0

SHA256:

41542DFC3594967B151C43E18FCE9194B656AB0B6EADA7F4C3C126A5A3EC2197

SSDEEP:

98304:MMtGs/pGWxyfx6LIaANx4ttsafu6bayPlsvMl2FACv0pVuorPltbTIspT+y19A3+:zQ6/PSw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • server.exe (PID: 1192)

    • NJRAT has been detected (YARA)

      • server.exe (PID: 1192)

    • NjRAT is detected

      • server.exe (PID: 1192)

    • Changes the autorun value in the registry

      • server.exe (PID: 1192)

  • SUSPICIOUS

    • Reads the Internet Settings

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)

    • The system shut down or reboot

      • server.exe (PID: 1192)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 1192)

    • Uses TASKKILL.EXE to kill process

      • server.exe (PID: 1192)

  • INFO

    • SecurityXploded is detected

      • WinRAR.exe (PID: 116)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 116)
      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • ilasm.exe (PID: 2672)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • server.exe (PID: 1192)
      • Server.exe (PID: 1956)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Manual execution by a user

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • Server.exe (PID: 1956)
      • iexplore.exe (PID: 3244)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Checks supported languages

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • ilasm.exe (PID: 2672)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Reads the computer name

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • njRAT v0.7d.exe (PID: 2568)
      • Server.exe (PID: 1956)
      • server.exe (PID: 1192)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3652)
      • NjRat 0.7D Green Edition by im523.exe (PID: 3856)

    • Reads Environment values

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • server.exe (PID: 1192)

    • Create files in a temporary directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 1636)
      • Server.exe (PID: 1956)

    • Starts itself from another location

      • Server.exe (PID: 1956)

    • Creates files or folders in the user directory

      • server.exe (PID: 1192)

    • Application launched itself

      • iexplore.exe (PID: 3244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1192) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f8782a013a20610e09216f21b705d856
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe no specs njrat 0.7d green edition by im523.exe no specs njrat v0.7d.exe no specs ilasm.exe no specs server.exe no specs #NJRAT server.exe netsh.exe no specs taskkill.exe no specs shutdown.exe no specs iexplore.exe iexplore.exe no specs njrat 0.7d green edition by im523.exe no specs njrat 0.7d green edition by im523.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\NjRat Builder.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1192"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
Server.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1192) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f8782a013a20610e09216f21b705d856
Splitter|'|'|
Versionim523
1636"C:\Users\admin\Desktop\BuilderNjRat\NjRat.07d\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\BuilderNjRat\NjRat.07d\NjRat 0.7D Green Edition by im523.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NjRat 0.7D Green Edition by im523
Exit code:
0
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\buildernjrat\njrat.07d\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1956"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2508netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2568"C:\Users\admin\Desktop\BuilderNjRat\njRAT v0.7\njRAT v0.7d.exe" C:\Users\admin\Desktop\BuilderNjRat\njRAT v0.7\njRAT v0.7d.exe—explorer.exe
User:
admin
Company:
njq8
Integrity Level:
MEDIUM
Description:
njRAT
Exit code:
3221225547
Version:
0.7.0.0
Modules
Images
c:\users\admin\desktop\buildernjrat\njrat v0.7\njrat v0.7d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2672"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\Server.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3060taskkill /F /IM Exsample.exeC:\Windows\System32\taskkill.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3096shutdown -l -t 00C:\Windows\System32\shutdown.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shutdown and Annotation Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
3244"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
15 791
Read events
15 437
Write events
349
Delete events
5

Modification events

(PID) Process:(116) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(116) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1636) NjRat 0.7D Green Edition by im523.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
39
Suspicious files
13
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.6.4\stub.iltext
MD5:1B92496B750A26F2450E34500A2C4215
SHA256:A1B65F18C7E882B1606A4EF9387D8988E6FD755D7D03214B677AD528A487D73A
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\README.mdtext
MD5:D621EF72336F55A09C80B055A91DD13D
SHA256:4B55045ACC6B7CFE93341DEB62283DAF14EC4C4E7F13DEF8E40E02FA2B3A97CC
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.5.0\stubSRC.rarcompressed
MD5:64F49FA1111B4D0894012422EEB0DCE6
SHA256:9A418406FDC61F98E9CFBA6C2BC5B34FB139DF2E97B6F60E2879C13220D374B0
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.6.4\Map\1416662483.jpgimage
MD5:5756169F9E385DD7F0A90C43CD050034
SHA256:842F230B004DC7744A1B885E00ADBC6737E5DD4A695BC2531C848ABE0ECA97A8
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.6.4\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.7\stub.iltext
MD5:2041E64BFFCCFBC9379235FDF294F188
SHA256:DAA4362A762A472F717A480102883382B41DC5C17484F649272C5BDB5142917C
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\njRAT v0.7\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\Sound\Sound.wavbinary
MD5:562FB3B4B1B1EAFD2CF107F2E92E0670
SHA256:5FF592B183B2C990448F1DCD842A29CFE17A3EAA9956E0135C945C578676344A
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\.gitignoretext
MD5:F4D61F06FF1F26F8A4BFD8CE606936CF
SHA256:FDC17FD35182CA77A4888C8682F48BA5B57463CA5865B96EB8A652BA15C63664
116WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb116.39718\BuilderNjRat\NjRat.07d\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3244
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
3244
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b760a1c8c8f99fe1
unknown
compressed
4.66 Kb
unknown
3244
iexplore.exe
GET
200
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5343d09680a02013
unknown
compressed
4.66 Kb
unknown
3244
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3244
iexplore.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
3244
iexplore.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3244
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3244
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.136
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.202
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRat Builder.7z