home

www.sendranchpresent.com

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
sendranchpresent.com

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
100.00%

The domain www.sendranchpresent.com has been seen to resolve to the following 6 IP addresses.

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
May 24, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 24, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 24, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
May 24, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
May 24, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
May 24, 2016

File downloads found at URLs served by www.sendranchpresent.com.

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=Wx8pOHckDIFMnTOllbCYfkQ9 OZB0Qhs2vqj/x1tmOg=&c=ZGqYkqttYXCZVzlOGNdlBlcLMEpaot/ltcmXqdzCN6WSyhiT wXA//msV4BSGezP6k3aR46mXznGRviPyniEM7BW1RNdMaINQrc2s6s9uXdJxnqrjGYx/pd8pcrN5NOI&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi  (9c93b18dc09215098a8e27f6a0e875f2)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=lZzuyYjmYGu6U2kk0s5BcxZ2XxL2OXWP25MXA64KsGU=&c=6Jz0BI8DVojT7vSU4pR0SoY GPXcS a1RTvgxt8NJALGeNYG5vMCtvFVkJAP7Ty8Jnqkf3J1NAqAxMyivCb4OfmgslTzNHXgc893B05QW OETfjjmoSPcpJYg5QsaOaRzpEUUUR2RHrmTdoa3T/NYrLZfI6GyynolVy9ZPq 5SM=&e=1&fallback_url=http://res.hufftos.com/.../install_flashplayer11x32_mssd_aih_other.exe  (5c69ba91e41ccac9ca29a6a7ae087153)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=64wCmzeG8AEY0b4Xg b/gBgkQuW/qKY18Pq6JIzkNao=&c=YEEGMzB0Q5MSnN5vBJYZZS6/MQsORCpcylzxc23Zlftkkl5FgLZ4mGOIbBytcp9H2AeMVqejT9IiBLpD pEdYTAwqWhZHUpYoM3oQ7Boj8g0Gc8zYM52dEFprr4N8iRRp6wS0HEtTG 3ZFKR3lUUdDN2tZg 9DWSMLXXJ8eVJk4=&e=1&fallback_url=http://res.hufftos.com/.../Photoshop.exe  (8e43824624dc6eaa45555aa45a9d9223)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=bk/RdDxbsbX7H9JrIy06C2SIR4gXjOtBVKPEg4xI4wE=&c=sidXBAjlpy3HftHjaVYeVgRUEc69Q9aAo9oJ8dCAtq6ju4L3mafjxT/Ks lK6/qbQO0kBHnAiRzFeU7UlddJ8Tvu TxklJ5ke8wYBiSyZsa9De43ygnA80egkqlgK6ydMepPeAWQYH3MD01xSQwWLVHTRkCXCfgSG6E8tSRnEbo=&e=1&fallback_url=http://res.hufftos.com/.../gimp-2.8.2-setup-1.exe  (e4c8d409fbece92aa55089c4080e55fa)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=m9AUWdbGx5kL71J9a04CmFlHv6qowa6FsOyblg0Uby0=&c=5pm1zaAUNPfvZgywNuMySwseow67Gjs2KrCnOWH5U7FiZ c7X3LcNqTQKKWz7s6aCnKq5sNZWwGC9H6f0Jky4JqOGcSeShDF4DZpxSEN4tC9UFLe tPA9riNbRRLjikVD u7O5kiEwsuxb3qvRoNjOZARATiVRDIY NSSPvhI8s=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe  (f2c0907fda37bf63d3d94edf3152b57e)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=5kgnKwc0TdMzFvtgz7xI6UCmtAEbwIiiQyWWFqF6aZE=&c=cauo0ZqNIJZ7pYnft5jnYE0SH9gS6zy1Es68QNzkjEJB0bI7PDzkXiDYaiJYjyC26L63igMHeHgXDul7rXYhvwVv1CaEd6JiI1ZJRGliQYJTWBm GBw1hX wHKG1Zu8f&fallback_url=http://res.hufftos.com/.../Opera_22.0.1471.50_Setup.exe  (c9540e1e9699d72479d0752d64b8db37)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=zMxc11J0YLiRh859VxFibTvfJqsyMr5 a8LEXrRU8Nc=&c=GLB8uBNHpzJ7SklpAKTO//i0AlBydJCpLO97QAXkg93b vTQWeyxJdvpViGAnnrS8sFxHwkiJJI1SZMfl6Ap13WW5Pmw2iWOKwcWHJo16ViVBkOvP4N9I4CHtiCJXBIa&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe  (7a6ebb756a1ad81c85f49e9b830c8b99)

1 / 68      (PUP)
http://www.sendranchpresent.com/c?x=af3uM5Rwqb9EhL0KnjM0spOeWS1VNqhRCmpkgta6NJ8=&c=dB0DwO7ym0KEBA/gL1sFBkWj0IGKeRJmVJxRp4UUyD5UCEk8Rk97DcZUQLO7xJlDLYTHEm5LbFGSbJtV4TOIhWVSWTDIAITxPpMGLtUpqfFJUjJeQ1uy0 a8jiHvBDnS&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe  (e63c0177d0618f722114d775ae959b3d)

The following 6 files have been seen to comunicate with www.sendranchpresent.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.