home

coolzipextractorapp.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain coolzipextractorapp.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in April of 2013. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Tuesday, April 23, 2013

Expires date:
Sunday, April 23, 2017

Updated date:
Wednesday, March 30, 2016

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
5 coolzipextractorapp.com records

Scanner detections:
Detections  (92% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.InstallCore.Internet.Installer.Meta (M), PUP.installCore (M), PUP.NewMedia.Installer.New Media Holdings.Installer (M), PUP.NewMedia.Installer.NewMediaHoldings.Installer (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.Installer.Bundler.Installer.Meta (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.InstallCore.S (M), PUP.InstallCore.RES (M), PUP.InstallCore.RE48 (M), PUP.NewMedia.NMH.Bundler (M), PUP.Installer.Bundler (M)
95.74%

VIPRE Antivirus
Threat.4150696, Threat.4786018, InstallCore
12.77%

ESET NOD32
Win32/InstallCore.ACZ potentially unwanted application, Win32/InstallCore.ADX.gen potentially unwanted application, Win32/InstallCore.XD potentially unwanted application
10.64%

K7 AntiVirus
Adware , Unwanted-Program
10.64%

Avira AntiVirus
PUA/InstallCore.EG.100, ADWARE/InstallCo.zkt, Adware/InstallCore.A.480, Adware/InstallCo.zkt
8.51%

Dr.Web
Trojan.InstallCore.33, Trojan.InstallCore.152
8.51%

AVG
Generic
8.51%

Malwarebytes
PUP.Optional.InstallCore, PUP.Optional.InstallCore.A
6.38%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
6.38%

G Data
Win32.Application.InstallCore.EG, Win32.Application.InstallCore.CZ
6.38%

Bkav FE
W32.HfsAdware
6.38%

avast!
Malware-gen
6.38%

Agnitum Outpost
PUA.InstallCore
4.26%

Sophos
PUA 'Install Core Click run software'
4.26%

NANO AntiVirus
Riskware.Win32.InstallCore.drfvvg, Riskware.Win32.InstallCore.dsgvyn
4.26%

The domain coolzipextractorapp.com has been seen to resolve to the following 6 IP addresses.

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
July 16, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
July 16, 2015

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
July 16, 2015

54.84.140.114
ec2-54-84-140-114.compute-1.amazonaws.com
May 5, 2015

54.236.147.238
ec2-54-236-147-238.compute-1.amazonaws.com
May 5, 2015

54.209.232.94
ec2-54-209-232-94.compute-1.amazonaws.com
May 5, 2015

File downloads found at URLs served by coolzipextractorapp.com.

0 / 68
http://coolzipextractorapp.com/?dl=1&pipi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck1zI3lwDSD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWSL4m7dREhKVuvmAWASDChTMm7dlChV8RAjc3AjnRNZnm7K2pDZ1fAz74NTa4NzndAg==&pd=2323UEVw rWPDk1z dD0UmNJ i==&campaignId=9jn0Aj7dNjMyAZMq  (SkypeSetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=Ajc4NZL0OTayNg==&osos=VdluDrW3cw==&chnl=ab-b_sa_chrome_win8_2015_3_25-0&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV8RAjazNjMROTnm7K2pDZ1fOT71AjM4OTnyAw==&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzawNza4AZMq  (windowsmoviemakersetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNzC4Nzg4AZCRvm5EIKiWXzaRAT70NjayNZa=&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjLyNTadAZMq  (minecraft_setup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATgzAZMzOTAwAw==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1dIXv02K5BUKxqvmCWcyDEcmlChSDBDz1l QDj7z1rLQDj rcWDK4m7z0RvmiWAkDjIKiWXzCzNjcdOTMFASDPDdlChV83NZgyAZC3AZaz&pd=2323UEsJck1P73xp2mLu7dWt&campaignId=9jn0AzA0NZ7yAZMq  (virtualdjsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVuvmNjhVxavmNBDz1l QDjhTnmDZ0wvmNpDZ1fATCROZC4AZCRvm5EIKiWXzCzAzi1NzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AjL4ATMdAZMq  (googleearthsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzg1OT7dOTMFASDPDdlChV8zNTiFAzc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AjC0AZcwAZMq  (spotifysetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=Az71ATiwNZg4AM==&osos=VdluDrW3cw==&chnl=b_sa_temp|broad&dr=hd5C m0WedNyDK50IXDlfSDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChVWZiL1iiLlHTlWvxkDG2z1YIdVF2dWyDH0m XiWed1P2rNo2HlwDX0m K4We3sB7KNl KVu2H0m73iWe3xPcm2l2H0m EiWedlmidWu2rVu2ZpnfXtpDlNl7XvjIZpLfSDleHsyhXtP7dVpDH0m7XMWed5CcrWzIXxp dFWvmxdhXtCDXDp7dVWvEsyhXMt KluDKNy7KD0vExthXN3DKV0OSDzcj1QDyDPDdlChVWsxn2ST1ViX0ln&pd=2323UEsB7XCt rlGDSFj d0=&campaignId=9jn0AzA0OZayAZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATiRNzadNjL1Nw==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1Q HVlc3xP7dtzvExthXN3DKV0NkDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWxVAm7dREhKVuvmAWASDChTMm7dlChV80AzL4NzgwOTnm7K2pDZ1fOTgdOTa4ATa0Ag==&pd=2323Um5wcHAt mV3UmNJ i==&campaignId=9jn0Azi3NZcdAZMq  (bluestackssetup.exe)

0 / 68
http://coolzipextractorapp.com/?dl=1&pi=Az7FAzaRNjM=&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1z2rVP SDphXAmD3vpDZ0m rcWDK4m7dAWiLLm7dREhKVuvmAWASDChTMm7dlChV80AZ7dNjCwOTnm7K2pDZ1fOZi0NzLdNzMyAw==&pd=2323UmxJ2d4t7XswcyFj d0=&campaignId=9jn0AzLyAj70AZMq  (steamsetup.exe-setup.website)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATA1NZM1Nz7wNw==&osos=VdluDrW3cw==&dr=cHaWck1PDH2j rVP mVyvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWIXim7dAWSVim7dREhKl0vmAWASDChTMm7dlChV8yAjCyNjMROTnm7K2pDZ1fAjgdOTC3OTnyAw==&pd=2323Um5wcHNGIKFCUmNJ i==&campaignId=9jn0AznyNzL0AZMq  (adwcleanersetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=AzMRAZiRATCFAi==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXi0vENyhKvEvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXzLdAzn3OZMFASDPDdlChV80AzAzATAwAjiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AjC0NTawAZMq  (googlechromesetup.exe)

0 / 68
http://coolzipextractorapp.com/?dl=1&pi=Azn3AznFAZMdAi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1zIdV07dP1ckD0 T1z2dVl2Z7mc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLvSvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAj7FNTMwATCRvm5EIKiWXzg0NZA4OZiRAjA=&pd=2323Um5wcHAtc3VyDSFj d0=&campaignId=9jn0AzLzAjAdAZMq  (sketchupsetup.exe-setup.website)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&dr=cHaWck112rWycmVu2kD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKl0vmNjhLlLvmNBDz1p2kDjhTnmDZ0wvmNpDZ1fOT70NjLzATiRvm5EIKiWXzM0NjCdAjLRAZA=&pd=2323Um2l2k1p EN07KRBUmNJ i==&campaignId=9jn0AjLzAjgyAZMq  (utorrent_setup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pipi=Ajg4NzcRAzg0Aw==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1TxyDj rcWDK4m7z0RvmiWAkDjIKiWXzg4AjAzOZMFASDPDdlChV8zAzMyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aj7dOT7yAZMq  (googlechromesetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pi=AjC3OZnwAjMFAM==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1z2rVP SD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV84Aj7dNjCwOTnm7K2pDZ1fATgRNjLdNzMyAw==&pd=2323UmxJ2d4t7XswcyFj d0=&campaignId=9jn0AzazAzc0AZMq  (steamsetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pi=AjCdAjAwOTgyOi==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8RNTnwAzgwOTnm7K2pDZ1fATA3AzayOZn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AjC1NTa4AZMq  (firefoxsetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pi=Ajg4NzcyAzi3Ai==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTAFNzg4AZCRvm5EIKiWXzn1OZgyNjayNZa=&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjgwNzgdAZMq  (minecraftsetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pi=AT7wOTAdAzn3OM==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0NSDzcj1QDyDphXAmD3vpDZ0m rcWIXim7dAWSVim7dREhKl0vmAWASDChTMm7dlChV84NZiFOTgwOTnm7K2pDZ1fNjaROTL4Aza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzA1ATa4AZMq  (teamviewersetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATawNTc3AZiyAg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1o 3vpemWuvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV81ATA4OTCwOTnm7K2pDZ1fNjC0NZa0AznyAw==&pd=2323UEsjUKtp2dCu7dWt&campaignId=9jn0Azi1AZidAZMq  (horizonsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATLwOZMdATAFOM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1wIKNPcdnm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXznzOZczAZnFASDPDdlChV80NzazATi3ATaz&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0Aza0AT7dAZMq  (picasasetup.exe)

2 / 68      (false positives)
http://coolzipextractorapp.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fOTCROZC4AZCRvm5EIKiWXzcRAzcdNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AjL4ATa0AZMq  (wrar420.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=AjC3NZLwNzMyAg==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8yAZAFAZMROTnm7K2pDZ1fAZgFOTazNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzAdATcyAZMq  (openofficesetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATA3OZC1Nja0Ai==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1p2kDj7z1vVkDj rcWIXim7z0RvmiWAkDjIKiWXzCzNZczOZMFASDPDdlChV8wAjaRNjC4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AzLwOTLwAZMq  (googlechromesetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&dr=cHaWck112rWycmVu2kD0 T1z2dVl2Zamc3aW7mcmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fATn0NjLzATiRvm5EIKiWXzgFNjAdAjLRAZA=&pd=2323Um2l2k1p EN07KRBUmNJ i==&campaignId=9jn0AjLFATLwAZMq  (utorrentsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATAzAZCyNZM1Ni==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8FAZAFAZMROTnm7K2pDZ1fAZ7RNTAzNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzazNj7yAZMq  (openofficesetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=Ajg4NzcRNZAdAi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1q7XDPvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXzARNZidOTMFASDPDdlChV83NzgyAZA3AZaz&pd=2323UmxJ2d4tDdV0UmNJ i==&campaignId=9jn0AjgyOZMyAZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (Adware)
http://coolzipextractorapp.com/?dl=1&pipi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1TxSDj rcWDK4m7z0RvmiWAkDjIKiWXzaFAjAzOZMFASDPDdlChV8yNTMyNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aj71OTcyAZMq  (googlechromesetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=Ajg4NzcRNZi1OM==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1HiQDj rcWDK4m7z0RvmiWAkDjIKiWXzMzATMzOZMFASDPDdlChV8wAZ7yAja4ATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjCzNjMyAZMq  (minecraftsetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&dr=c3aW7mcm2r0Wc32lDXimcHaWck1JcrVu dDmIKNlvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzC3AZLyATn0ASDPDdlChV8wOTAyNjMzAT7y&pd=2323Uml0UXvP2rLu7dWt&campaignId=9jn0AjLFAjayAZMq  (openofficesetup.exe)

1 / 68      (PUP)
http://coolzipextractorapp.com/?dl=1&pi=ATadAjARNTgyOM==&osos=VdluDrW3cw==&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7dATi1AZnFASDPDdlChV8yOZMdNzC3ATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0Azn0OTAyAZMq  (gtaivsanandreassetup.exe)

 
Latest 30 of 55 download URLs

The following 3 files have been seen to comunicate with coolzipextractorapp.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

August 22, 2016
usv.coolzipextractorapp.com

December 11, 2013
www.coolzipextractorapp.com

URL:
http://coolzipextractorapp.com/

Title:
“Thank you page”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.