home

cdn.tribogamercontent.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain cdn.tribogamercontent.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in April of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Portland, Oregon within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform from the US West (Oregon) region datacenter.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Oregon, United States (US)

Create date:
Thursday, April 24, 2014

Expires date:
Monday, April 24, 2017

Updated date:
Wednesday, March 30, 2016

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
tribogamercontent.com

Whois:
3 tribogamercontent.com records

Scanner detections:
Detections  (91% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.STMSetup.Q, PUP.STMSetup.R, PUP.STMSetup.K, PUP.STMSetup.I, PUP.AstroNetworkFriedCookie.R, PUP.Installer.InstallCore.Installer, PUP.Installer.InstallCore.ironSource, PUP.InstallCore.Installer.Installer (M), PUP.installCore.STMSetup (M), PUP.InstallCore.Installer (M), PUP.InstallCore.FC.Installer (M), PUP.InstallCore.FC (M), PUP.installCore (M)
92.86%

K7 AntiVirus
Riskware , Trojan , Unwanted-Program
42.86%

Dr.Web
Adware.InstallCore.386, Trojan.MulDrop5.10078, Trojan.InstallCore.16, Trojan.InstallCore.31
38.10%

VIPRE Antivirus
Threat.4150696, Trojan.Win32.Generic, Threat.4786018, InstallCore
38.10%

Avira AntiVirus
Adware/InstallCore.A.760, ADWARE/InstallCore.Gen7, ADWARE/InstallCore.Gen9, Adware/InstallCo.zkw, PUA/InstallCore.Gen7, ADWARE/InstallCo.zkw
38.10%

Sophos
Install Core Click run software, PUA 'Install Core Click run software'
38.10%

AVG
Generic
38.10%

Baidu Antivirus
Adware.Win32.InstallCore, Adware.Win32.Agent
33.33%

ESET NOD32
Win32/InstallCore.PK potentially unwanted application, Win32/InstallCore.OU potentially unwanted application, Win32/InstallCore.PO potentially unwanted application
28.57%

Norman
Suspicious_Gen4.CFEAW, InstallCore.CERT, Suspicious_Gen4.CNSJW
26.19%

ESET NOD32
Win32/InstallCore.PK (variant), Win32/InstallCore.OL (variant), Win32/InstallCore.TL potentially unwanted (variant), Win32/InstallCore.QW potentially unwanted (variant)
11.90%

herdProtect (fuzzy)
a variant of f3fe76dab2a44f9a192944a03b18b52e6d4473cb, a variant of d424a8999c7c9bb14bc6d58594d4a8f3b4706bd4, a variant of b68af642bc985a50021c235043f235d35bfdc064
11.90%

NANO AntiVirus
Riskware.Win32.InstallCore.dfglnj, Riskware.Win32.InstallCore.dmfokt, Riskware.Win32.InstallCore.dnajzr
11.90%

Bkav FE
W32.Clod1c6.Trojan, W32.HfsAdware
9.52%

McAfee
Artemis!E145F8367CC6, CryptInno, Artemis!40299DF0F606, Artemis!9CA244C211EC
9.52%

The domain cdn.tribogamercontent.com has been seen to resolve to the following 34 IP addresses.

52.36.112.186
ec2-52-36-112-186.us-west-2.compute.amazonaws.com
September 3, 2016

52.34.184.36
ec2-52-34-184-36.us-west-2.compute.amazonaws.com
September 3, 2016

52.10.159.134
ec2-52-10-159-134.us-west-2.compute.amazonaws.com
July 31, 2016

54.200.224.121
ec2-54-200-224-121.us-west-2.compute.amazonaws.com
July 31, 2016

54.148.183.210
ec2-54-148-183-210.us-west-2.compute.amazonaws.com
July 31, 2016

52.33.46.229
ec2-52-33-46-229.us-west-2.compute.amazonaws.com
July 8, 2016

54.191.246.249
ec2-54-191-246-249.us-west-2.compute.amazonaws.com
July 8, 2016

54.186.99.90
ec2-54-186-99-90.us-west-2.compute.amazonaws.com
July 8, 2016

52.41.114.34
ec2-52-41-114-34.us-west-2.compute.amazonaws.com
July 8, 2016

52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
June 5, 2016

52.33.165.25
ec2-52-33-165-25.us-west-2.compute.amazonaws.com
June 5, 2016

52.32.12.104
ec2-52-32-12-104.us-west-2.compute.amazonaws.com
June 5, 2016

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 18, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 18, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 19, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 19, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 19, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
February 3, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
February 3, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
February 3, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
February 3, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
February 3, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
February 3, 2016

54.218.9.198
ec2-54-218-9-198.us-west-2.compute.amazonaws.com
September 1, 2015

54.186.184.17
ec2-54-186-184-17.us-west-2.compute.amazonaws.com
September 1, 2015

54.186.33.198
ec2-54-186-33-198.us-west-2.compute.amazonaws.com
July 1, 2015

54.201.218.17
ec2-54-201-218-17.us-west-2.compute.amazonaws.com
June 19, 2015

52.25.88.134
ec2-52-25-88-134.us-west-2.compute.amazonaws.com
May 21, 2015

54.200.107.209
ec2-54-200-107-209.us-west-2.compute.amazonaws.com
May 4, 2015

54.171.1.146
ec2-54-171-1-146.eu-west-1.compute.amazonaws.com
May 4, 2015

 
Showing 30 of 34 IP Addresses

File downloads found at URLs served by cdn.tribogamercontent.com.

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../hitman_absolution-v1.00[www.tribogamer.com].exe  (hitman_absolution.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../injustice_coalesced_30_45_60fps.exe  (injustice_coalesc.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../Coalesced.por.exe  (ba8aa3d3821c07ad5936caa286d28586)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../stalker_cop-v1.00[www.tribogamer.com.br].exe  (stalker_cop-v1.00.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../dead_space_br-v1.02[www.tribodosrenegados.com.br].exe  (dead_space_br-v1..exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../BioShockInfiniteTradu_C_eo.BR.exe  (bioshockinfinitet.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../dishonored-v1.00[www.tribogamer.com].exe  (dishonored-v1.00[].exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../Backup.AoM.Extended.Edition.Pack.ptBR.exe  (backup.aom.extend.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/c?x=rJyf0H9PVAUgQ7Q3H2QyVHZ73Gtnlm5m7SJm5 xd9ww=&c=7NzjNFy9Jc2RdMuDIYilRPLWG9MlU0DH41 hc79cX9pekQ26Wpa4by7BESymre837W5Bly1rEkLyjlpeBwS wA==&downloadAs=skyrim_br-v1.00[www.tribogamer.com].exe&fallback_url=http://www.tribogamer.com/jogos/.../?id=147  (c1ddc19078b26526d98a6335d7faf430)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../TextosPTBR.exe  (6d3141de1ce81208ccd8b9062e32e2b7)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../cod_black_ops_br-v1.02[www.tribodosrenegados.com.br].exe  (cod_black_ops_br-.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../PackdeIdioma.exe  (07ba212acf8a20565ce9956d113b948c)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/c?x=5H0CrdsX/hRVeA0J1VbTSlcdE1fDE76HKefFOIFWtus=&c=vot573q3C898IwYKG2y1AeHiIV1Yusp9DEBXRHBKbQhgu5M8fbEJLIxG w TWjfTONd1pvXruaHw1tvK2NS 5E1be3FX3SI5Aa58LQTk2/w=&fallback_url=http://www.tribogamer.com/jogos/.../?id=135&downloadAs=pop_tfs-v1.00[www.tribogamer.com].exe  (pop_tfs-v1.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../sleeping_dogs__br-v1.00[www.tribogamer.com].exe  (não confirmado 319590.crdownload)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../twd_cp-v1.00[www.tribogamer.com].exe  (twd_cp-v1.00[].exe)

4 / 68
http://cdn.tribogamercontent.com/.../twd_ep2-v1.00[www.tribogamer.com].exe  (40299df0f6063a22a19c27796cedd79b)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../the_escapists_br-v1.00[tribogamer.com].exe  (the_escapists_br-.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../cod_ghosts_br-v1.01[www.tribogamer.com].exe  (cod_ghosts_br-v1..exe)

0 / 68
http://cdn.tribogamercontent.com/.../assassins_creed_ii-v1.01[www.tribogamer.com].exe  (assassins_creed_i.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/.../fnv_br.exe  (6236443aa33352182ec5fda23309179d)

10 / 68    (Adware)
http://cdn.tribogamercontent.com/.../Tradu_C_eoDMC5.exe  (de51b6fad46cc2643e5383a57af2bcc7)

11 / 68    (Adware)
http://cdn.tribogamercontent.com/.../sev2_tradu_steam_fix.7z.exe  (sev2_tradu_steam_.exe)

1 / 68      (Adware)
http://cdn.tribogamercontent.com/c?x=Gt/3trd5zQUThJod/dLy86Pt2Rzcd1y83qICoi95oDU=&c=tISaz1TQmxDxbH6V7vtdLYcNSh9Kp5mzgM8zDdCwl/XWvfUSPUF0M4c9xhPi gq5E0hnI4TV89I3vsLTVdHmoQ==&downloadAs=Tradu_C_eoArmaIII.exe&fallback_url=http://www.tribogamer.com/jogos/.../?id=733  (0cce520f1737bd68f3f2f26a7404e54a)

20 / 68    (Adware)
http://cdn.tribogamercontent.com/c?x=bb5J89lqOS0QBfeUQFSlUlQ6GETJPhDVMq5ppDa7zlc=&c=DkG5U9oclX9f1IPjpYD9 PsxaUMHnP19n8Ad8OR/YADA8p11g7OrdzK8L8p8/Pr926C3MKlpOxCHxgypuL1KyQ==&downloadAs=metro_2033_br-v1.01[www.tribodosrenegados.com.br].exe&fallback_url=http://www.tribogamer.com/jogos/.../?id=58  (9ca244c211ece1cf5fbc0e0559d2dac2)

17 / 68    (Adware)
http://cdn.tribogamercontent.com/c?x=bCTxAADjP4U/U9F88NXDaI7z/w0VRR5Nmr2cJTkwY5w=&c=UkhwccYslxzCg6ekznMmQbjjEBt og4zXxTbGRuH4xXHdAx7GBzyjS0NIRM GIsHdzAGDPbW1Ty/ngyYlDrer5wUrsK4j987Q02fsdjhQes=&fallback_url=http://www.tribogamer.com/jogos/.../?id=972&downloadAs=BAO_DUB_Cold_Cold.exe  (6ab74853559f7893658983b4a32a296f)

14 / 68    (Adware)
http://cdn.tribogamercontent.com/.../dragonage.traducao.revisada.online.exe  (dragonage.traduca.exe)

6 / 68      (inconclusive)
http://cdn.tribogamercontent.com/.../i_am_alive-v1.00[www.tribogamer.com].exe  (i_am_alive-v1.00[].exe)

1 / 68
http://cdn.tribogamercontent.com/.../metroll_br-v1.03[www.tribogamer.com].exe  (metroll_br-v1.03[].exe)

15 / 68    (Adware)
http://cdn.tribogamercontent.com/c?x=3ztWamtO2MEuGzLAxstXiWD7pmelS8gPXSV7Po9uDos=&c=Bln2QLWZKS4vdqv1PQS85/hSawnmX1fld43eIOpXARQ4fIj0jcF32mQ43FucKDEpDOCkJTw38/wxM2/m7PFWCA==&downloadAs=DevilMayCry4Tradu.exe&fallback_url=http://www.tribogamer.com/jogos/.../?id=882  (17fe700c6585d2963fe4f890a819f830)

10 / 68    (Adware)
http://cdn.tribogamercontent.com/.../data_win64.exe  (6cd513097fc5df94b4021533b6299bc8)

 
Latest 30 of 43 download URLs

The following 51 files have been seen to comunicate with cdn.tribogamercontent.com in live environments.

TCP » 52.38.209.219:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.33.46.229:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.33.46.229:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.38.209.219:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.38.209.219:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 52.34.184.36:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.200.224.121:80
browser.exe (Browser)

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.34.184.36:80
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.200.224.121:80
kometa.exe (Kometa by @COMPANY_FULLNAME@)

TCP » 52.38.209.219:80
browser.exe (Browser)

TCP » 52.33.46.229:80
citrio.exe (Citrio by CatalinaGroup)

TCP » 52.34.184.36:80
browser.exe (Browser)

TCP » 54.200.224.121:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.34.184.36:80
UCBrowser.exe (UC Browser by UCWeb)

TCP » 52.34.184.36:80
BrowserSafer.exe (BrowserSafer by Installer Technology Co)

TCP » 54.200.224.121:80
ShopAtHome_BAC_Service.exe (by ShopAtHome.com)

TCP » 54.200.224.121:80
browser.exe (Browser)

TCP » 52.34.184.36:80
Client.exe

 
Latest 20 of 101 files

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.