(explorer.exe). However, when checking its hash on VirusTotal, the sample seems to be very new, just a few hours old at the time. In the affected environment, it looks as if the njRat is contacting two IP addresses: one of them was unknown to us at the time (capeturk.com - more...