home

top-greatapp.com

Privacy Protection Service INC d/b/a PrivacyProtect.org  (Proxy Registrant)

Domain Information

The domain top-greatapp.com is registered by proxy through PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM and was originally registered in November of 2014. This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Ashburn, Virginia within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Web Services (AWS) cloud computing platform.
Registrar:
PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM

Server location:
Virginia, United States (US)

Create date:
Sunday, November 16, 2014

Expires date:
Wednesday, November 16, 2016

Updated date:
Sunday, October 25, 2015

ASN:
AS14618 AMAZON-AES - Amazon.com, Inc.,US

Whois:
2 top-greatapp.com records

Scanner detections:
Detections  (92% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.installCore (M), PUP.InstallCore.Internet.Installer.Meta (M), PUP.NewMedia.Installer.installCore.Installer (M), PUP.InstallCore.S (M), PUP.InstallCore.RES (M), PUP.NewMedia.NMH.installCore.Installer (M), PUP.installCore.Program.Installer.Meta (M), PUP.InstallCore.RE48 (M)
90.91%

Dr.Web
Adware.Conduit.37, Trojan.InstallCore.152
9.09%

ESET NOD32
Win32/InstallCore.ZP potentially unwanted application, Win32/InstallCore.ZM potentially unwanted application
9.09%

VIPRE Antivirus
Threat.4150696, InstallCore
9.09%

AVG
InstallCore, Generic
9.09%

Agnitum Outpost
PUA.Toolbar.Conduit
4.55%

ESET NOD32
Win32/Toolbar.Conduit.B potentially unwanted (variant)
4.55%

IKARUS anti.virus
PUA.Toolbar.Conduit
4.55%

G Data
Win32.Application.InstallCore.EG
4.55%

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
4.55%

herdProtect (fuzzy)
a variant of ce01730349e00b9583799a30eb7d971cf03fd0e9
4.55%

Bkav FE
W32.HfsAdware
4.55%

Malwarebytes
PUP.Optional.InstallCore.A
4.55%

K7 AntiVirus
Adware
4.55%

Baidu Antivirus
Adware.Win32.InstallCore
4.55%

The domain top-greatapp.com has been seen to resolve to the following 3 IP addresses.

54.84.143.69
ec2-54-84-143-69.compute-1.amazonaws.com
August 12, 2015

52.7.132.182
ec2-52-7-132-182.compute-1.amazonaws.com
August 12, 2015

107.23.203.23
ec2-107-23-203-23.compute-1.amazonaws.com
August 12, 2015

File downloads found at URLs served by top-greatapp.com.

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck1zcrW0IKDFvExthXN3DKV0vENyhKvEvmCWcyDEcmlChSDBDz1mcQDj7z1rLQDj rcWDEam7z0RvmiWAkDjIKiWXzLFOT7dOTMFASDPDdlChV84NTidNjc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AjczOT70AZMq  (spotifysetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=AzA4NzM0AZ70Ai==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL55vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZgzNjC4AZCRvm5EIKiWXzCRNZCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AzMFAzg4AZMq  (popcorntimesetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcyAj7yAM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z15LyDj rcWDK4m7z0RvmiWAkDjIKiWXzidOT7dOTMFASDPDdlChV8yAjL0NZc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AjgzATgwAZMq  (spotifysetup.exe)

1 / 68      (Adware)
http://top-greatapp.com/?dl=1&pi=ATL4AziyATM3Ni==&osos=VdluDrW3cw==&chnl=&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhL55vmNBDz1l QDjhTnmDZ0wvmNpDZ1fOZgzNjC4AZCRvm5EIKiWXzMyNZCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AziwAZiyAZMq  (popcorntimesetup.exe)

4 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=NzL4AjgRNZn0&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1j 3Vu2rVyUXN0cmlGDS1J mRp mLm2r0Wc32lDXiFvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXz7dAzi1AZnFASDPDdlChV8dNzc3NzM4ATaz&pd=2323Um2yDK50UKtp miu7dWt&campaignId=9jn0AzLwATiwAZMq  (counterstrikesetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=AznzNji4NZAFAi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1q7XDPvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXznRNZidOTMFASDPDdlChV8dAjLFOTa3AZaz&pd=2323UmxJ2d4tDdV0UmNJ i==&campaignId=9jn0Azi1NjM0AZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcRNzg0Ni==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1zcrW0IKDFvmCWcyDEcmlChSDBDz1l QDj7z1ZiSDj rcWDK4m7z0RvmiWAkDjIKiWXzL3OT7dOTMFASDPDdlChV8zAZi0NTc3AZaz&pd=2323UmxJ2dFB d5CDrW3 QFj d0=&campaignId=9jn0AjCyOTAdAZMq  (spotifysetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Azn3NjaFAzC1Ni==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck10DK5t2mll2dVyvExthXN3DKV0NSDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8yNz7FOTgwOTnm7K2pDZ1fNzCFAT74Aza0Ag==&pd=2323UmDyDKVBDK2l mxPcECu7dWt&campaignId=9jn0AzaFOTadAZMq  (teamviewersetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcROTayAM==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1dIXv02K5BUKxqvmCWcyDEcmlChSDBDz1l QDj7z1VLyDj rcWDK4m7z0RvmiWAkDjIKiWXzcyNjcdOTMFASDPDdlChV8yNzndOZg3AZaz&pd=2323UEsJck1P73xp2mLu7dWt&campaignId=9jn0AjCwAzC4AZMq  (virtualdjsetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=AzAFOZAzAzcFAi==&osos=VdluDrW3cw==&dr=cHaWck1uDXvJUK11 Hxp KVCIKntc3Vp2rLm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXznFATAwAZnFASDPDdlChV8FAZg1NTa0ATaz&pd=2323UENJDEitIdluDkFj d0=&campaignId=9jn0Azn1NzMdAZMq  (pneromultimediasuitesetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=ATi3NznwATAwAi==&osos=VdluDrW3cw==&dr=c3aW7mcm2r0Wc32lDXimcHaWck1q7XDPvmCWcyDEcmlChSDBDz1lcyDj7z15LyDj rcWDXAm7z0RvmiWAkDjIKiWXz7RNZidOTMFASDPDdlChV80Aja3AZA3AZaz&pd=2323UmxJ2d4tDdV0UmNJ i==&campaignId=9jn0AzMdOZ74AZMq  (javaruntimeenvironmentsetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=ATi1NZaRAzCzNi==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=cHaWck1P2KxP7dl0eSD0 T1z2dVl2kDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWx0am7dREhKVuvmAWASDChTMm7dlChV8wNZgdAjMROTnm7K2pDZ1fOTAFAjgwNjnyAw==&pd=2323UmD1 Q1E d2JUmNJ i==&campaignId=9jn0AziyAZcdAZMq  (audioeditorandrecordersetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcyAZgzAw==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLFAvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNj7zNjC4AZCRvm5EIKiWXzn4AzCzNTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AjcFAjawAZMq  (popcorntimesetup.exe)

1 / 68      (Adware)
http://top-greatapp.com/?dl=1&pi=AjLdNTc4OTCROM==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1PDH2j rVP mVyvExthXN3DKV0OSDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV80AjCyNjMROTnm7K2pDZ1fNz70OTC3OTnyAw==&pd=2323Um5wcHNGIKFCUmNJ i==&campaignId=9jn0Azi1AZidAZMq  (adwcleanersetup.exe)

1 / 68      (Adware)
http://top-greatapp.com/?dl=1&pi=ATAFNT70NTgdNg==&osos=VdluDrW3cw==&dr=cHaWck1w 3sj 3vuUXxp KLm2r0Wc32lDXimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNZM0NjC4AZCRvm5EIKiWXzLzNZc0NTAyNZa=&pd=2323Um2JDd8t2XsB d5CUmNJ i==&campaignId=9jn0AjC3Az70AZMq  (popcorntimesetup.exe)

13 / 68    (Adware)
http://top-greatapp.com/?dl=1&pi=AjC3NZCdNTcFNi==&osos=VdluDrW3cw==&chnl=b_sa_sign_win8&dr=cHaWck1jIHvJ KLm2r0Wc32lDXiyvENyhKvEvmCWcyDEcmlChSDBDz1w2kDj7z1kLQDj rcWcHim7z0RvmiWAkDjIKiWXz7zNjazOZMFASDPDdlChV83NTiwNzA4ATiy&pd=2323UExJck1EIXDlUmNJ i==&campaignId=9jn0Aza3NznyAZMq  (GoogleChromeSetup.exe)

0 / 68
http://top-greatapp.com/?dl=1&pi=AjczNzcdOTLRNw==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=cHaWck1uDKVCUKDJcQ1zcrVlDk13 3vBDkD0 T1z2dVl2Zimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLlOvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNzaFATc4AZCRvm5EIKiWXzA0ATM0AzMyNZa=&pd=2323UEvP2rV1cdLu7dWt&campaignId=9jn0AzL0NjL4AZMq  (need for speed worldsetup.exe-setup.website)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Azc1Ajg1NjidAg==&osos=VdluDrW3cw==&dr=cHaWck1E2r5fSVDfcd5uXd5uDHvl7XAm2r0Wc32lDXidvENyhKvEvmCWcyDEcmlChSDBDz1l QDj7z1vTQDj rcWDK4m7z0RvmiWAkDjIKiWXzgRAZcFOTMFASDPDdlChV84NTL3OTMzATaz&pd=2323Umtp2dCtc3VuUmNJ i==&campaignId=9jn0AzndNjc4AZMq  (gtaivsanandreassetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=ATAdATC1Nzg4Oi==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1wIKNPcdnmIT1zvm2yIKiWvmREhKVuvmNjhLVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTiyNT7FAZCRvm5EIKiWXzAyOZiwNTcwAjA=&pd=2323UEVwUK2J diu7dWt&campaignId=9jn0AzA0NZ7yAZMq  (picasasetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Ajg4NzcyAjMdAM==&osos=VdluDrW3cw==&dr=cHaWck1w7KR07KRGUK1lc3Nl m2lcQD0 T1z2dVl2Z7mc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLlLvmNBDz1l QDjhTnmDZ0wvmNpDZ1fOTLyAzMwATCRvm5EIKiWXz7dAjARAziRAjA=&pd=2323UEN1 Q1GIX2pUmNJ i==&campaignId=9jn0AjgzNZ74AZMq  (paltalkmessengersetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=Azn3NzCyNTgdNg==&osos=VdluDrW3cw==&dr=cHaWck1mIXvlDmW4vExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWcHim7dAWilam7dREhXs0vmAWASDChTMm7dlChV8dNjC4AZMROTnm7K2pDZ1fAzi4NZnzNTnyAw==&pd=2323UEvP2rLt2XNlUmNJ i==&campaignId=9jn0AzMzNZ7dAZMq  (firefoxsetup.exe)

1 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=ATA0AZa1OZAzNi==&osos=VdluDrW3cw==&dr=cHaWck1uDKVCUKDJcQ1zcrVlDk13 3vBDkD0 T1z2dVl2Zimc3aW7mcmIT1zvm2yIKiWvmREhKVuvmNjhLx5vmNBDz1l QDjhTnmDZ0wvmNpDZ1fNTAFATc4AZCRvm5EIKiWXzC0ATM0AzMyNZa=&pd=2323UEvP2rV1cdLu7dWt&campaignId=9jn0AzM4ATa4AZMq  (needforspeedworldsetup.exe)

0 / 68
http://top-greatapp.com/?dl=1&pi=AT7dOT7RATLFNM==&osos=VdluDrW3cw==&chnl=b_sa_ch&dr=c3aW7mcm2r0Wc32lDXimcHaWck1E dWE rLtDK5y2rgmIT1zvm2yIKiWvmREhKVuvmNjhVVTvmNBDz1l QDjhTnmDZ0wvmNpDZ1fNj7ROZC4AZCRvm5EIKiWXzCwAziyNzAyNZa=&pd=2323UENJDEx37XvlUK2l2kFj d0=&campaignId=9jn0AzLzOZAwAZMq  (googleearthsetup.exe-setup.website)

6 / 68      (PUP)
http://top-greatapp.com/?dl=1&pi=ATL4OZLyATa3NM==&osos=VdluDrW3cw==&chnl=b_sa_chwin8&dr=c3aW7mcm2r0Wc32lDXimcHaWck13IKFy7XamIT1zvm2yIKiWvmREhKVuvmNjhL2kvmNBDz1l QDjhTnmDZ0wvmNpDZ1fAZC4Nj7FAZCRvm5EIKiWXzi0OT7yNzcwAjA=&pd=2323Um5wcHAtDdV0UmNJ i==&campaignId=9jn0AzazATiwAZMq  (winrarsetup.exe)

The following 3 files have been seen to comunicate with top-greatapp.com in live environments.

TCP » 54.84.143.69:80
WajamInternetEnhancer.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 54.84.143.69:80
notifier64.exe (Notifications)

TCP » 54.84.143.69:80
ContentFinder.exe (ContentFinder by ContentFinder Company)

URL:
http://top-greatapp.com/

Title:
“SweetPCApp”

Network:
Amazon Web Services (AWS), running an EC2 instance

Web server:
nginx/1.4.7

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.