» free-soft-now.org
Overview
Analysis
IPs Addresses (7)
Downloads (27)
Network (14)
Website Detail

free-soft-now.org

Privacy Protection Service INC d/b/a PrivacyProtect.org (Proxy Registrant)

Domain Information

The domain free-soft-now.org is registered by proxy through PDR Ltd. d/b/a PublicDomainRegistry.com. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.

Registrant:

Privacy Protection Service INC d/b/a PrivacyProtect.org

Registrar:

PDR Ltd. d/b/a PublicDomainRegistry.com

Server location:

Virginia, United States (US)

ASN:

AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:

2 free-soft-now.org records

Scanner detections:

Detections (96% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.Win.Reputation, PUP.InstallCore.Bundler (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.installCore (M), PUP.NewMedia.Installer.NewMediaHoldings.Installer (M), PUP.Installer.Bundler.Installer.Meta (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.S (M), PUP.InstallCore.RES (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.Installer.Bundler (M)

92.59%

ESET NOD32

Win32/InstallCore.ZC potentially unwanted application, Win32/InstallCore.ZP potentially unwanted application, Win32/InstallCore.ACZ potentially unwanted application

14.81%

VIPRE Antivirus

Threat.5084491

7.41%

avast!

Win32:Malware-gen

7.41%

Baidu Antivirus

Adware.Win32.InstallCore

7.41%

Agnitum Outpost

Trojan.Badur

3.70%

G Data

Win32.Application.InstallCore.EG

3.70%

Vba32 AntiVirus

Malware-Cryptor.InstallCore.gen

3.70%

Fortinet FortiGate

Riskware/InstallCore

3.70%

The domain free-soft-now.org has been seen to resolve to the following 7 IP addresses.

209.99.40.221

209-99-40-221.fwd.datafoundry.com

August 18, 2016

54.84.143.69

ec2-54-84-143-69.compute-1.amazonaws.com

July 26, 2015

52.7.132.182

ec2-52-7-132-182.compute-1.amazonaws.com

July 26, 2015

107.23.203.23

ec2-107-23-203-23.compute-1.amazonaws.com

July 26, 2015

54.84.140.114

ec2-54-84-140-114.compute-1.amazonaws.com

May 28, 2015

54.236.147.238

ec2-54-236-147-238.compute-1.amazonaws.com

May 28, 2015

54.209.232.94

ec2-54-209-232-94.compute-1.amazonaws.com

May 28, 2015

File downloads found at URLs served by free-soft-now.org.

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=AjCdNTn1OTgzOM==&osos=VdluDrW3cw==&dr=cHaWck13IKFC 32zUK1J2mllUK1PIdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzgROZ7dOTMFASDPDdlChV8dOTn1AZc3AZaz&pd=2323UmxJ2d4tcdWm2H2PcmLu7dWt&campaignId=9jn0AzMdAjLdAZMq (windowsmoviemakersetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Az7zOZn4NZ73Ng==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWVVAm7dREhKVuvmAWASDChTMm7dlChV80AzC4NZgwOTnm7K2pDZ1fOTLyATMdOTn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0Azn1AzgyAZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATgRNzAzOZndAg==&osos=VdluDrW3cw==&dr=cHaWck1w 32lcEsJIKF0UXDpDX2lcQD0 T1z2dVl2ZLmc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZ7FAjnFAZCRvm5EIKiWXzLFNTazAjAwAjA=&pd=2323Um2l2k11cdLu7dWt&campaignId=9jn0AjC4AzcyAZMq (powerpointviewersetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=AjC3AjA4NZg1Ag==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck11 ml0eS13DKatcrRPeKVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1kLQDj rcWDK4m7z0RvmiWAkDjIKiWXzcdNZM3OTMFASDPDdlChV81AZn1NTL4AZaz&pd=2323UEsJck1p EN07KRBUmNJ i==&campaignId=9jn0Azi4AzM0AZMq (unitywebplayersetup.exe)

1 / 68 (Adware)

http://free-soft-now.org/?dl=1&pi=ATLRNZnROZLyOi==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8FNZnwAzgwOTnm7K2pDZ1fNzn3AzayOZn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AzazOTn0AZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATC3NT71AZn0Aw==&osos=VdluDrW3cw==&dr=cHaWck1C 32u rWPDk1t7KFPDdVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzn3NTn3OTMFASDPDdlChV8zNTgyNZ74AZaz&pd=2323Umluc3xP rwt mV3UmNJ i==&campaignId=9jn0AjC3NZcyAZMq (downloadmanagersetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATA4Az7wNz74Ni==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1wIKNPcdnm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXznzOZczAZnFASDPDdlChV8RAjczATi3ATaz&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0AzAwOTA0AZMq (picasasetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=OZAROTa1AzLy&osos=VdluDrW3cw==&dr=cHaWck1t7K2p7y1j dRB7K2lvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWLngm7dREhKVuvmAWASDChTMm7dlChV8wNjiyAZMROTnm7K2pDZ1fNj7dATcwNZnyAw==&pd=2323Umtp2dCtD3vl7Xiu7dWt&campaignId=9jn0AzMzNzCwAZMq (magiccollagesetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATL1AZMwAzM0Oi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck1wIKNPcdnmIT1zvm2yIKiWvmREhKVuvmNjhL55vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTLyNT7FAZCRvm5EIKiWXzczATgyNTcwAjA=&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0Azi4AZA0AZMq (picasasetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATi3AzgwAznyNw==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z15LyDj rcWDK4m7z0RvmiWAkDjIKiWXzidOT7dOTMFASDPDdlChV8yAjL0NZc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AzMdNjLyAZMq (spotifysetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck13IKFy7Xam2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKDyvmNjhLDSvmNBDz1mcQDjhTnmDZ0wvmNpDZ1fAznFNj7FAZCRvm5EIKiWXzCzAjgzNzcwAjA=&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AjgyNZc4AZMq (winrarsetup.exe)

1 / 68 (Adware)

http://free-soft-now.org/?dl=1&pi=ATCzNZCwATg=&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzM1AZMzOZMFASDPDdlChV8dATaFATa4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Azi4NzAdAZMq (googlechromesetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=AzL4AZCRNTM4NM==&osos=VdluDrW3cw==&chnl=ab-b_sa_nosign_chrome_2015_3_25-0&dr=cHaWck1w7KR07KRGUK1lc3Nl m2lcQD0 T1z2dVl2Z7mc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVN5vmNBDz1l QDjhTnmDZ0wvmNpDZ1fNjiyAzMwATCRvm5EIKiWXzi0AzMRAziRAjA=&pd=2323UEN1 Q1GIX2pUmNJ i==&campaignId=9jn0AzawNZC0AZMq (paltalkmessengersetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATi4Nzg1Aj71Nw==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0AQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8RNTnwAzgwOTnm7K2pDZ1fNTL3AzayOZn0Ag==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AjCdATL4AZMq (firefoxsetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATC1OTizNTnROi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1yDKN12mnm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXz7RNjLwAZnFASDPDdlChV8FNTg0OTc0ATaz&pd=2323Umtp2dCtIdluDkFj d0=&campaignId=9jn0AzizNzn0AZMq (recuvasetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhXs0vmNjhLvSvmNBDz1w2kDjhTnmDZ0wvmNpDZ1fNTC4Nzg4AZCRvm5EIKiWXzARAT70NjayNZa=&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjCRAZ70AZMq (minecraftsetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL17vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTgzNjC4AZCRvm5EIKiWXzMRNZM0NTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0Ajc0AZCwAZMq (popcorn timesetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATiwNjMwNzAdAi==&osos=VdluDrW3cw==&dr=cHaWck1wIKNPcdnm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXznzOZczAZnFASDPDdlChV8dNzMzATi3ATaz&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0AzM0OZg4AZMq (picasasetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATazOZMFATiyNi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7dATi1AZnFASDPDdlChV8yOZMdNzC3ATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0AziyNZCwAZMq (gtaivsanandreassetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck13IKF6IXMm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z15LyDj rcWDK4m7z0RvmiWAkDjIKiWXz7wAj7RAzn0ASDPDdlChV8FAzg4AZAzATMz&pd=2323UmxJ2dFB d5CDdWP HAu7dWt&campaignId=9jn0AjgFATLdAZMq (winzipsetup.exe)

1 / 68 (Adware)

http://free-soft-now.org/?dl=1&pi=ATAdAj73OZAdAw==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDEam7dAWxlam7dREhKDyvmAWASDChTMm7dlChV8FAZAFAZMROTnm7K2pDZ1fAznFATAzNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0Aza1NZi0AZMq (openofficesetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=cHaWck1tIKFl73vPDEim2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7yATMzOZMFASDPDdlChV8FAjiyAja4ATiy&pd=2323UmRlDdVuDrVyeS1PcHszUmNJ i==&campaignId=9jn0AjCzOTM4AZMq (minecraftsetup.exe)

2 / 68 (inconclusive)

http://free-soft-now.org/?dl=1&pi=ATgRNjg1NZLFAM==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL55vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZgzNjC4AZCRvm5EIKiWXzCRNZCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzMyNznwAZMq (popcorntimesetup.exe)

1 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATn1OTC3NzM4NM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1E dWE rLtDK5y2rgm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNjMyOZC4AZCRvm5EIKiWXzMzOTa3NzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AziyAjA4AZMq (googleearthsetup.exe)

7 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=NjAyNzn0OTLR&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0NSDzcj1QDyDphXAmD3vpDZ0m rcWIXim7dAWSVim7dREhKl0vmAWASDChTMm7dlChV83NZiFOTgwOTnm7K2pDZ1fATMyOTL4Aza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzA0NZadAZMq (teamviewersetup.exe)

4 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATawOTL4OZ7RAM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzLwNjczOZMFASDPDdlChV8RNT7zAzMFATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0AzAwOTLyAZMq (googlechromesetup.exe)

3 / 68 (PUP)

http://free-soft-now.org/?dl=1&pi=ATAwAj7yNzLzAi==&osos=VdluDrW3cw==&dr=cHaWck1wDr7tcmVPDrVyvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1OTkDj rcWDK4m7z0RvmiWAkDjIKiWXza0Nz7yAZnFASDPDdlChV8zOTM3NTMdATaz&pd=2323Uml0UKD1 QFj d0=&campaignId=9jn0AzM4NZcwAZMq (pdfreadersetup.exe)

The following 14 files have been seen to comunicate with free-soft-now.org in live environments.

TCP » 209.99.40.221:80

winsemr.exe (winsemr)

TCP » 209.99.40.221:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 209.99.40.221:80

winregis.exe

TCP » 209.99.40.221:80

browser.exe (speed browser by Smart Applications)

TCP » 209.99.40.221:80

criticalsupdates.exe (WindowsApplication1)

TCP » 209.99.40.221:80

win_register.exe

TCP » 209.99.40.221:80

winsemr.exe (winsemr)

TCP » 209.99.40.221:80

winregis.exe

TCP » 209.99.40.221:80

rundll.exe

TCP » 209.99.40.221:80

winregis.exe

TCP » 209.99.40.221:80

UCBrowser.exe (UC Browser by UCWeb)

TCP » 54.84.143.69:80

WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80

notifier64.exe (Notifications)

TCP » 54.84.143.69:80

ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:

http://free-soft-now.org/

Google Analytics:

UA-53913188

Title:

“File-Opener”

Network:

Amazon Web Services (AWS), running an EC2 instance

Web server:

nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.