URL:

https://memreducts.ru/

Full analysis: https://app.any.run/tasks/75a1de3a-7004-4dd3-a49a-c90199fb8553
Verdict: Malicious activity
Analysis date: January 30, 2022, 13:04:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F5E684D10E27BE3FBAD45FA4E4DC63CA

SHA1:

5670E4343FBA295E6478E70B7DAFFE7F0177E126

SHA256:

B734C6F4F404F9B9CE55E9BB329B13387F97F6CE5CE8658CFD802B15A1C113C3

SSDEEP:

3:N81QBr:21Ur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • memreduct.exe (PID: 2424)
      • memreduct.exe (PID: 1332)
      • memreduct.exe (PID: 3488)
      • memreduct.exe (PID: 488)
      • memreduct-3.4-setup.exe (PID: 2872)
      • memreduct-3.4-setup.exe (PID: 320)

    • Drops executable file immediately after starts

      • memreduct.exe (PID: 2424)
      • memreduct.tmp (PID: 2868)
      • memreduct.exe (PID: 1332)
      • memreduct.exe (PID: 3488)
      • memreduct-3.4-setup.exe (PID: 320)

    • Changes settings of System certificates

      • memreduct.tmp (PID: 2868)

    • Loads dropped or rewritten executable

      • memreduct.exe (PID: 3488)
      • memreduct-3.4-setup.exe (PID: 320)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3992)

    • Checks supported languages

      • memreduct.exe (PID: 2424)
      • WinRAR.exe (PID: 2924)
      • memreduct.tmp (PID: 1068)
      • memreduct.exe (PID: 1332)
      • memreduct.tmp (PID: 2868)
      • memreduct.exe (PID: 3488)
      • memreduct.exe (PID: 488)
      • memreduct-3.4-setup.exe (PID: 320)

    • Reads the computer name

      • WinRAR.exe (PID: 2924)
      • memreduct.tmp (PID: 1068)
      • memreduct.tmp (PID: 2868)
      • memreduct.exe (PID: 3488)
      • memreduct.exe (PID: 488)
      • memreduct-3.4-setup.exe (PID: 320)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2924)
      • memreduct.exe (PID: 2424)
      • memreduct.exe (PID: 1332)
      • memreduct.tmp (PID: 2868)
      • memreduct.exe (PID: 3488)
      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3992)
      • memreduct-3.4-setup.exe (PID: 320)

    • Reads Windows owner or organization settings

      • memreduct.tmp (PID: 2868)

    • Reads the Windows organization settings

      • memreduct.tmp (PID: 2868)

    • Drops a file with too old compile date

      • memreduct.tmp (PID: 2868)

    • Drops a file that was compiled in debug mode

      • memreduct.tmp (PID: 2868)

    • Adds / modifies Windows certificates

      • memreduct.tmp (PID: 2868)

    • Creates a directory in Program Files

      • memreduct.exe (PID: 3488)

    • Creates files in the program directory

      • memreduct.exe (PID: 3488)

    • Creates a software uninstall entry

      • memreduct.exe (PID: 3488)

    • Creates files in the user directory

      • memreduct.exe (PID: 3488)
      • memreduct.exe (PID: 488)

    • Drops a file with a compile date too recent

      • memreduct.exe (PID: 3488)

    • Searches for installed software

      • memreduct-3.4-setup.exe (PID: 320)

    • Executed via COM

      • DllHost.exe (PID: 3340)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3992)
      • DllHost.exe (PID: 3340)

    • Reads the computer name

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 3444)
      • DllHost.exe (PID: 3340)

    • Changes internet zones settings

      • iexplore.exe (PID: 2920)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3992)
      • iexplore.exe (PID: 2920)
      • memreduct.tmp (PID: 2868)
      • memreduct.exe (PID: 488)

    • Creates files in the user directory

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 2920)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3992)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3992)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2920)

    • Application launched itself

      • iexplore.exe (PID: 2920)

    • Application was dropped or rewritten from another process

      • memreduct.tmp (PID: 1068)
      • memreduct.tmp (PID: 2868)

    • Loads dropped or rewritten executable

      • memreduct.tmp (PID: 2868)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2920)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2920)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
13
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe memreduct.exe memreduct.tmp no specs memreduct.exe memreduct.tmp memreduct.exe memreduct.exe memreduct-3.4-setup.exe no specs memreduct-3.4-setup.exe PhotoViewer.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\memreduct-3.4-setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\memreduct-3.4-setup.exe
iexplore.exe
User:
admin
Company:
Henry++
Integrity Level:
HIGH
Description:
Mem Reduct
Exit code:
2
Version:
3.4
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\memreduct-3.4-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
488"C:\Program Files\Mem Reduct\memreduct.exe"C:\Program Files\Mem Reduct\memreduct.exe
memreduct.exe
User:
admin
Company:
Henry++
Integrity Level:
HIGH
Description:
Mem Reduct
Exit code:
0
Version:
3.3.5
Modules
Images
c:\program files\mem reduct\memreduct.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1068"C:\Users\admin\AppData\Local\Temp\is-IHDDB.tmp\memreduct.tmp" /SL5="$3024E,6760135,159232,C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe" C:\Users\admin\AppData\Local\Temp\is-IHDDB.tmp\memreduct.tmp—memreduct.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ihddb.tmp\memreduct.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1332"C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe" /SPAWNWND=$20258 /NOTIFYWND=$3024E C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe
memreduct.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Mem Reduct Setup (r2108042017)
Exit code:
0
Version:
3.3.5
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2924.8555\memreduct.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2424"C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Mem Reduct Setup (r2108042017)
Exit code:
0
Version:
3.3.5
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2924.8555\memreduct.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2868"C:\Users\admin\AppData\Local\Temp\is-UUU01.tmp\memreduct.tmp" /SL5="$30256,6760135,159232,C:\Users\admin\AppData\Local\Temp\Rar$EXa2924.8555\memreduct.exe" /SPAWNWND=$20258 /NOTIFYWND=$3024E C:\Users\admin\AppData\Local\Temp\is-UUU01.tmp\memreduct.tmp
memreduct.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uuu01.tmp\memreduct.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2872"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\memreduct-3.4-setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\memreduct-3.4-setup.exe—iexplore.exe
User:
admin
Company:
Henry++
Integrity Level:
MEDIUM
Description:
Mem Reduct
Exit code:
3221226540
Version:
3.4
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\memreduct-3.4-setup.exe
c:\windows\system32\ntdll.dll
2920"C:\Program Files\Internet Explorer\iexplore.exe" "https://memreducts.ru/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2924"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\memreduct.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
3340C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
39 340
Read events
38 950
Write events
382
Delete events
8

Modification events

(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30938585
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
216763653
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30938586
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
18
Suspicious files
46
Text files
98
Unknown types
39

Dropped files

PID
Process
Filename
Type
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A07ECF0226EA781EA737B3DEFBF959Fbinary
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A07ECF0226EA781EA737B3DEFBF959Fder
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\003[1].jpgimage
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
116
DNS requests
43
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3444
iexplore.exe
GET
200
23.32.238.27:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgP6tIFnMrfycJl8NkYcK4Vejw%3D%3D
US
der
503 b
shared
3444
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3444
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEFKxQHtEPcBCgAAAAErfHU%3D
US
der
471 b
whitelisted
3444
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3444
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC04WHG3wyS9QoAAAABK3x8
US
der
472 b
whitelisted
3444
iexplore.exe
GET
200
2.16.186.163:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso
unknown
der
1.50 Kb
whitelisted
3444
iexplore.exe
GET
200
23.32.238.27:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPah55KjaxsBoJnUG0SVSVEYA%3D%3D
US
der
503 b
shared
3444
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEC9ImKyTYWXsCgAAAAErgtY%3D
US
der
471 b
whitelisted
3444
iexplore.exe
GET
200
2.16.186.163:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
unknown
der
1.54 Kb
whitelisted
3444
iexplore.exe
GET
200
23.32.238.27:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMhDytFv2lFb61n36w6dXUODg%3D%3D
US
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3444
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
XO Communications
US
unknown
3444
iexplore.exe
23.32.238.27:80
r3.o.lencr.org
XO Communications
US
unknown
3444
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
3444
iexplore.exe
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
3444
iexplore.exe
77.88.55.66:443
yandex.ru
YANDEX LLC
RU
whitelisted
3444
iexplore.exe
23.105.236.220:443
memreducts.ru
Servers.com, Inc.
RU
malicious
3444
iexplore.exe
92.38.252.165:443
allstat-pp.ru
JSC Digital Network
RU
suspicious
3444
iexplore.exe
87.250.250.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3444
iexplore.exe
142.250.186.66:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3444
iexplore.exe
88.212.201.216:443
counter.yadro.ru
United Network LLC
RU
suspicious

DNS requests

Domain
IP
Reputation
memreducts.ru
  • 23.105.236.220
malicious
ctldl.windowsupdate.com
  • 23.32.238.208
  • 23.32.238.178
  • 23.32.238.201
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 23.32.238.27
  • 23.32.238.67
  • 23.32.238.83
shared
pagead2.googlesyndication.com
  • 142.250.186.66
whitelisted
allstat-pp.ru
  • 92.38.252.165
whitelisted
yandex.ru
  • 77.88.55.66
  • 5.255.255.50
  • 5.255.255.55
  • 77.88.55.70
whitelisted
cdn-rtb.sape.ru
  • 95.181.171.231
  • 95.181.171.233
unknown
mc.yandex.ru
  • 87.250.250.119
  • 77.88.21.119
  • 93.158.134.119
  • 87.250.251.119
whitelisted
counter.yadro.ru
  • 88.212.201.216
  • 88.212.201.198
  • 88.212.201.204
  • 88.212.201.210
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://memreducts.ru/