File name:

NjRAT ACS Version.rar

Full analysis: https://app.any.run/tasks/d1b035dd-64e2-4731-a1fb-12e5941a15ea
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: August 14, 2024, 19:05:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
njrat
bladabindi
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1ED7DBE6AA630A373D794388281BD514

SHA1:

2817F7AECC4F7D81CB42DE1B62BEEA77B6E19CA6

SHA256:

80EB6E3F8B123AA19111B35005D4C0AD07ABCCB8DE41FF946103C1C5E16D0452

SSDEEP:

49152:hqtRhpsL+z+wCjdeuPZiSMUARSfIGgUHpXepXWyFqVmO/Oq8hP+ch3ga7+EHZx6A:haGB3eCZiSbAEDHMpXxMVmO/4n3+KZAA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Server.exe (PID: 3256)

    • NjRAT is detected

      • Server.exe (PID: 3256)

    • Password recovery utility (NirSoft) for browsers is detected

      • NirSoft.exe (PID: 5908)

    • Steals credentials from Web Browsers

      • NirSoft.exe (PID: 5908)

    • Actions looks like stealing of personal data

      • NirSoft.exe (PID: 5908)

    • Uses NirSoft utilities to collect credentials

      • NirSoft.exe (PID: 5908)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6352)
      • Server.exe (PID: 3256)
      • ilasm.exe (PID: 6568)
      • NjRat ACS Version.exe (PID: 6736)

    • Reads security settings of Internet Explorer

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)

    • Reads Internet Explorer settings

      • NjRat ACS Version.exe (PID: 6736)

    • Reads the date of Windows installation

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)

    • Executable content was dropped or overwritten

      • Server.exe (PID: 3256)
      • ilasm.exe (PID: 6568)
      • NjRat ACS Version.exe (PID: 6736)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server.exe (PID: 3256)

    • The executable file from the user directory is run by the CMD process

      • NirSoft.exe (PID: 5908)

    • Start notepad (likely ransomware note)

      • NjRat ACS Version.exe (PID: 6736)

    • Starts CMD.EXE for commands execution

      • Server.exe (PID: 3256)

  • INFO

    • Reads the machine GUID from the registry

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)
      • NirSoft.exe (PID: 5908)
      • RegAsm.exe (PID: 2132)

    • Manual execution by a user

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6352)

    • Checks supported languages

      • NjRat ACS Version.exe (PID: 6736)
      • ilasm.exe (PID: 6568)
      • Server.exe (PID: 3256)
      • NirSoft.exe (PID: 5908)
      • TextInputHost.exe (PID: 904)
      • RegAsm.exe (PID: 2132)

    • Reads Environment values

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)

    • Reads the computer name

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)
      • RegAsm.exe (PID: 2132)
      • NirSoft.exe (PID: 5908)
      • TextInputHost.exe (PID: 904)

    • Process checks computer location settings

      • NjRat ACS Version.exe (PID: 6736)
      • Server.exe (PID: 3256)

    • Create files in a temporary directory

      • NjRat ACS Version.exe (PID: 6736)
      • NirSoft.exe (PID: 5908)

    • Creates files or folders in the user directory

      • Server.exe (PID: 3256)
      • NirSoft.exe (PID: 5908)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe njrat acs version.exe ilasm.exe conhost.exe no specs #NJRAT server.exe netsh.exe no specs conhost.exe no specs regasm.exe no specs cmd.exe no specs conhost.exe no specs nirsoft.exe notepad.exe no specs textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Windows\System32\cmd.exe" /C C:\Users\admin\AppData\Roaming\NirSoft.exe /stext C:\Users\admin\AppData\Roaming\browser.txtC:\Windows\SysWOW64\cmd.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
904"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1168\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1448"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\nj_users\DESKTOP-JGLLJLD_admin_26B799FA\PASS.txtC:\Windows\SysWOW64\notepad.exe—NjRat ACS Version.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
2132"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3256"C:\Users\admin\Desktop\Server.exe" C:\Users\admin\Desktop\Server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3864netsh firewall add allowedprogram "C:\Users\admin\Desktop\Server.exe" "Server.exe" ENABLEC:\Windows\SysWOW64\netsh.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5908C:\Users\admin\AppData\Roaming\NirSoft.exe /stext C:\Users\admin\AppData\Roaming\browser.txtC:\Users\admin\AppData\Roaming\NirSoft.exe
cmd.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
Web Browser Password Viewer
Exit code:
0
Version:
2.06
Modules
Images
c:\users\admin\appdata\roaming\nirsoft.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6352"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\NjRAT ACS Version.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 416
Read events
16 287
Write events
125
Delete events
4

Modification events

(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\NjRAT ACS Version.rar
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6736) NjRat ACS Version.exeKey:HKEY_CURRENT_USER\SOFTWARE\NjRAT ACS Version
Operation:writeName:port
Value:
5552
(PID) Process:(6736) NjRat ACS Version.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:writeName:5
Value:
4E006A0052006100740020004100430053002000560065007200730069006F006E002E0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000
Executable files
12
Suspicious files
2
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5908NirSoft.exeC:\Users\admin\AppData\Local\Temp\bhvD916.tmp —
MD5:—
SHA256:—
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\Plugin\mic.dllexecutable
MD5:D4C5DDC00F27162FC0947830E0E762B7
SHA256:B6FB6B66821E70A27A4750B0CD0393E4EE2603A47FEAC48D6A3D66D1C1CB56D5
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\Plugin\plg.dllexecutable
MD5:0CBC2D9703FEEAD9783439E551C2B673
SHA256:EA9ECF8723788FEEF6492BF938CDFAB1266A1558DFFE75E1F78A998320F96E39
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\Plugin\pw.dllexecutable
MD5:C1182C0968E09888DA053D3D04D13EAF
SHA256:A7249F3A847B2D5513EA1A26575A3776AAAD848CDA2AD740A295EBB7EDB8647B
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\WinMM.Net.dllexecutable
MD5:D4B80052C7B4093E10CE1F40CE74F707
SHA256:59E2AC1B79840274BDFCEF412A10058654E42F4285D732D1487E65E60FFBFB46
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\GeoIP.datbinary
MD5:797B96CC417D0CDE72E5C25D0898E95E
SHA256:8A0675001B5BC63D8389FC7ED80B4A7B0F9538C744350F00162533519E106426
6568ilasm.exeC:\Users\admin\Desktop\Server.pdbbinary
MD5:9F68B1A301CF5E03E5531646492CFE62
SHA256:E9D198B572BADE665F54DBF020F936792B0B0EA179C2A5054358A067F8F8C525
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6352.17474\stub.iltext
MD5:2041E64BFFCCFBC9379235FDF294F188
SHA256:DAA4362A762A472F717A480102883382B41DC5C17484F649272C5BDB5142917C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
38
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1536
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7140
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1536
svchost.exe
GET
304
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3140
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1108
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5336
SearchApp.exe
184.86.251.28:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1536
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1536
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.bing.com
  • 184.86.251.28
  • 184.86.251.11
  • 184.86.251.17
  • 184.86.251.14
  • 184.86.251.24
  • 184.86.251.21
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.134
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 184.86.251.28
  • 184.86.251.11
  • 184.86.251.21
  • 184.86.251.24
  • 184.86.251.17
  • 184.86.251.14
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NjRAT ACS Version.rar