File name:

Red Gate .NET Reflector 11.1.0.2167_fu11.rar

Full analysis: https://app.any.run/tasks/7349bcf8-6c56-4a2c-975b-3948d13a1415
Verdict: Malicious activity
Analysis date: November 03, 2021, 23:26:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F231F116F36DEB5E1F9FBD80598F117D

SHA1:

5E7AEFA342EE26C35B02AEE5E910609435968811

SHA256:

407B1B30EABE875C14EBE0841E993D20B533CC55019AF8C0209000A583C2B732

SSDEEP:

196608:iJj/xE5WjsfcYUYTuUlPQx1UoOvRrE6snKFZVQOcVQd8U/4MX6JElq:ip/y5WjsASGXdqmKN4Lwq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)

    • Application was dropped or rewritten from another process

      • ReflectorInstaller_softoroom.net.exe (PID: 2092)
      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • Keygen.exe (PID: 1344)
      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Loads dropped or rewritten executable

      • Keygen.exe (PID: 1344)
      • SearchProtocolHost.exe (PID: 592)
      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Drops executable file immediately after starts

      • Keygen.exe (PID: 1344)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3304)
      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • RedGate.Installer.UI.App.exe (PID: 3844)
      • Keygen.exe (PID: 1344)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3304)
      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Checks supported languages

      • WinRAR.exe (PID: 3304)
      • RedGate.Installer.UI.App.exe (PID: 3844)
      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • Keygen.exe (PID: 1344)

    • Adds / modifies Windows certificates

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)

    • Drops a file with too old compile date

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Executable content was dropped or overwritten

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • WinRAR.exe (PID: 3304)
      • RedGate.Installer.UI.App.exe (PID: 3844)
      • Keygen.exe (PID: 1344)

    • Searches for installed software

      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Executed as Windows Service

      • msiexec.exe (PID: 472)

    • Reads the Windows organization settings

      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Reads Windows owner or organization settings

      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Reads Environment values

      • RedGate.Installer.UI.App.exe (PID: 3844)

  • INFO

    • Reads settings of System Certificates

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • RedGate.Installer.UI.App.exe (PID: 3844)
      • chrome.exe (PID: 3924)

    • Checks Windows Trust Settings

      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • RedGate.Installer.UI.App.exe (PID: 3844)

    • Reads the computer name

      • SearchProtocolHost.exe (PID: 592)
      • msiexec.exe (PID: 472)
      • WISPTIS.EXE (PID: 1132)
      • chrome.exe (PID: 3460)
      • chrome.exe (PID: 3456)
      • chrome.exe (PID: 2404)
      • chrome.exe (PID: 3924)
      • chrome.exe (PID: 320)
      • chrome.exe (PID: 2152)

    • Checks supported languages

      • SearchProtocolHost.exe (PID: 592)
      • msiexec.exe (PID: 472)
      • WISPTIS.EXE (PID: 1132)
      • chrome.exe (PID: 3460)
      • chrome.exe (PID: 880)
      • chrome.exe (PID: 2404)
      • chrome.exe (PID: 3924)
      • chrome.exe (PID: 2596)
      • chrome.exe (PID: 972)
      • chrome.exe (PID: 3456)
      • chrome.exe (PID: 3500)
      • chrome.exe (PID: 2252)
      • chrome.exe (PID: 736)
      • chrome.exe (PID: 3180)
      • chrome.exe (PID: 3232)
      • chrome.exe (PID: 3764)
      • chrome.exe (PID: 756)
      • chrome.exe (PID: 1560)
      • chrome.exe (PID: 3308)
      • chrome.exe (PID: 3132)
      • chrome.exe (PID: 1092)
      • chrome.exe (PID: 2572)
      • chrome.exe (PID: 2080)
      • chrome.exe (PID: 320)
      • chrome.exe (PID: 2152)
      • chrome.exe (PID: 2228)
      • chrome.exe (PID: 2972)

    • Manual execution by user

      • ReflectorInstaller_softoroom.net.exe (PID: 2092)
      • ReflectorInstaller_softoroom.net.exe (PID: 1240)
      • Keygen.exe (PID: 1344)
      • chrome.exe (PID: 3460)

    • Application launched itself

      • chrome.exe (PID: 3460)

    • Reads the hosts file

      • chrome.exe (PID: 3460)
      • chrome.exe (PID: 3924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
33
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe reflectorinstaller_softoroom.net.exe no specs reflectorinstaller_softoroom.net.exe redgate.installer.ui.app.exe msiexec.exe no specs wisptis.exe no specs wisptis.exe no specs keygen.exe searchprotocolhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,15998019794377077577,2382750080396375653,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2732 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
472C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
592"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
736"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,15998019794377077577,2382750080396375653,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3600 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
756"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,15998019794377077577,2382750080396375653,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6dc7d988,0x6dc7d998,0x6dc7d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
972"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,15998019794377077577,2382750080396375653,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,15998019794377077577,2382750080396375653,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\winmm.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernelbase.dll
1132"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—RedGate.Installer.UI.App.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1240"C:\Users\admin\Desktop\Red Gate .NET Reflector 11.1.0.2167_fu11\ReflectorInstaller_softoroom.net.exe" C:\Users\admin\Desktop\Red Gate .NET Reflector 11.1.0.2167_fu11\ReflectorInstaller_softoroom.net.exe
Explorer.EXE
User:
admin
Company:
Red Gate Software Ltd
Integrity Level:
HIGH
Description:
Redgate Installer
Exit code:
0
Version:
3.2.4.2829
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\red gate .net reflector 11.1.0.2167_fu11\reflectorinstaller_softoroom.net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winspool.drv
Total events
22 011
Read events
21 824
Write events
187
Delete events
0

Modification events

(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3304) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Red Gate .NET Reflector 11.1.0.2167_fu11.rar
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3304) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
71
Suspicious files
38
Text files
95
Unknown types
16

Dropped files

PID
Process
Filename
Type
3304WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3304.19409\Red Gate .NET Reflector 11.1.0.2167_fu11\Crack\Readme.txttext
MD5:—
SHA256:—
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\SQLToolBeltInstaller.projectpi2
MD5:5C81E1E2241A662C2D11945C4D470640
SHA256:CDE11EF571E5A9377A51498ABB9EF7AA5C73D12448615E6C514886FF9DF75A75
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.Installer.LongFileName.dllexecutable
MD5:66248496A67973639D12FD6194354C30
SHA256:B6244C62195385D31AB104BD768A6F19F87D7DDDEFD11300F7030FCCCB6DB994
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.Installer.ParameterParsing.dllexecutable
MD5:0CCFF149A1854D1C2CC48AD774A42E46
SHA256:B3D67E160B2CD1A6671B3484A7C3916694F80DE70B946E42EBE48402A9700DDB
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\Serilog.dllexecutable
MD5:4E3ACD7B861F636482E12EF9DB039A4E
SHA256:F98BB72E462CC9BBD652C647D1088A73BE9B889AEB8302991C89D7B8E5FA8239
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.Installer.CompressionInterfaces.dllexecutable
MD5:B758F66A9FDD0CC200F2BC2C71654980
SHA256:2F96F19107814F4620329F6187E6DD9D157BBC7924AAD85339333184EE63E2CE
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.InstallerEngine.Interfaces.dllexecutable
MD5:C70A4D6F6983E4382CB754D2C3CE68D6
SHA256:35932E0F8848BD07B673158805AA9075539C2283CD2F424297D17F142DB7B726
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.Installer.ProductParsing.dllexecutable
MD5:50699D3B8EE7FD679F8250B200ACFEE8
SHA256:E137C5A53C2FECA697D7FB952A5E7DFA24DF6B16E15069A3819F0FCC9442FFD0
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.Installer.Logging.dllexecutable
MD5:1280990DDC9DD6F7C8DBF2B2DA1A1C6B
SHA256:9133EAD544986E6B2E42F023205B82CB3C1BB850F0450976400A6B30CCF8BD95
1240ReflectorInstaller_softoroom.net.exeC:\Users\admin\AppData\Local\Temp\{D4257D52-B9B1-48D8-9CF5-3E91920C19B1}\RedGate.CompressEngine.dllexecutable
MD5:3471CF6249EC816198AB7634FBDDC879
SHA256:76E294137D4FD5EF38DDAD3F5F9E2B4B83B84C84B97E1702CACD472BCF1301B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
14
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3844
RedGate.Installer.UI.App.exe
52.49.20.80:443
productusage.red-gate.com
Amazon.com, Inc.
IE
suspicious
3924
chrome.exe
142.250.186.173:443
accounts.google.com
Google Inc.
US
suspicious
3924
chrome.exe
142.250.74.206:443
clients2.google.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.181.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.184.196:443
www.google.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.186.99:443
www.gstatic.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.186.74:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.185.67:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.185.161:443
lh5.googleusercontent.com
Google Inc.
US
whitelisted
3924
chrome.exe
142.250.186.78:443
encrypted-tbn0.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
productusage.red-gate.com
  • 52.49.20.80
  • 52.48.48.251
malicious
featureusage.red-gate.com
  • 52.49.20.80
  • 52.48.48.251
malicious
clientservices.googleapis.com
  • 142.250.181.227
whitelisted
www.google.com
  • 142.250.184.196
malicious
clients2.google.com
  • 142.250.74.206
whitelisted
accounts.google.com
  • 142.250.186.173
shared
fonts.googleapis.com
  • 142.250.186.74
whitelisted
www.gstatic.com
  • 142.250.186.99
whitelisted
fonts.gstatic.com
  • 142.250.185.67
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.78
whitelisted

Threats

PID
Process
Class
Message
3924
chrome.exe
Generic Protocol Command Decode
SURICATA STREAM CLOSEWAIT FIN out of window
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Red Gate .NET Reflector 11.1.0.2167_fu11.rar