Download
Community
knowledgeBase
» www.nowtagheart.com
Overview
Analysis
IPs Addresses (12)
Downloads (11)
Network (23)
www.nowtagheart.com
Domain Information
Server location:
Oregon, United States (US)
ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US
Root domain:
nowtagheart.com
Analysis
Scanner detections:
Detections (100% detected)
Scan engine
Details
Detections
Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
100.00%
IPs Addresses
The domain www.nowtagheart.com has been seen to resolve to the following 12 IP addresses.
54.149.195.20
ec2-54-149-195-20.us-west-2.compute.amazonaws.com
June 27, 2016
52.41.114.34
ec2-52-41-114-34.us-west-2.compute.amazonaws.com
June 27, 2016
52.38.209.219
ec2-52-38-209-219.us-west-2.compute.amazonaws.com
June 27, 2016
52.33.46.229
ec2-52-33-46-229.us-west-2.compute.amazonaws.com
June 27, 2016
52.32.12.104
ec2-52-32-12-104.us-west-2.compute.amazonaws.com
June 27, 2016
54.191.246.249
ec2-54-191-246-249.us-west-2.compute.amazonaws.com
June 27, 2016
52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
May 23, 2016
52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 23, 2016
52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 23, 2016
54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
May 23, 2016
54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
May 23, 2016
54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
May 23, 2016
Downloads
File downloads found at URLs served by www.nowtagheart.com.
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=0FuWlYtaPeuavTHVXsjd0sPJRqLc1454GXHTamw1m94=&c=rkmBpMIMHYlVT0ONm qCmMXOs81m6G/NgJUQ0i 4TMU0ZflNwXvrdX3aF4JJHZbA9QidGH/ aItq2B8UFwnOeTrqum85VJnS79Un7nWPZ9E3bREum0mAmsv0rTr5FyhqJ7wdmq140ja6WVg9yglW1qOcaFrISvd4Y8Cl74xSx7I=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(f2c0907fda37bf63d3d94edf3152b57e)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=N3yHtc/NF/NJ/roAouJXAeTzSf5KhpET99fstsmJCJY=&c=E5 GfBIFlXBlJqVt0Wr7MlLdsyCjmAbM5lSLn4YVRZeBArn9ugfqba7fbVy9qVvb6GZR2CKp4Eu3FQ88kSixdsvhFwMY IhgIAhA3bnLmODa7kTVJkVkIv1421wLxkBJllswa/EhgFVyQhFfCilSLkjA4loh6DEK19JmBAaZ23M=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(388ccda3fd709fa02dde7940736e5fd3)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=eYQpKoSA21WHChKVXzNz/oTkx3IgeDHczzRsFRdqBUU=&c=LqvB32 qzJ77tSoOHYxFL17GADdBDGfnGd1fSSPMBb8gI5QmD5W4AgVpGf4BTnjDKSugZJnSZbR8TF2cSSj2g9tzuSS3Ll8yehpMjwy5fzqo8puYiAQQDjj4orRdGtHEpwNBzE5K0aMomEZ25xVYRc0A7OKc0HQqYWmzKsC1ufY=&e=1&fallback_url=http://res.wosoth.com/cache/upch/.../UpdateChecker.exe
(edc90de148f8e02e171ce7b455506840)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=iE 4/Goj165yXpe0ZI7eQDlbQZTOBqXzg1ityuvRDdY=&c=v4g2 2O8nSOWnJ9XQ9DbMCyW1cwv2j0AfGU/IuC5UEjFlFVYf1ug/QBsmXm54Cwh8 pnX7e/z0lb/MmSSRCiM WqgJEPo7jVoxG016u82LdaoZOwmqfy6ciY1Mf/0dlI87HDs0EJd3Epq2mUICmBfCX14ig9OJLRAZ9y0BUISkM=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(f2c0907fda37bf63d3d94edf3152b57e)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=1asXK4Syir/iNdZipFkvhzHnIQ4jbook6IwjiZI2qT8=&c=bJh1LtsV01ImgrcKdtgvpJYvOC79AK0LuBqcMVg9VVarckfRB4s6XhhDhCL41Q12pidd/3S241Eh7IIT2XX39vCdDVAV/HdEXchrugIoD8REwCXYnSx/oCdSO88 My7z&fallback_url=http://res.setauls.com/.../ChromeSetup_fr.exe
(d6392f3fced89091c1067a52736fbc48)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=pr9eIijX66BelLf2sA1ruAKXcxnSWWeVYyBkCOynzmg=&c=H4MKpF997J1AXw pjhiLMOiMylBbgrS5tjFcAe2CG6kM5ugjyjq4M yYqnc6zLE6dvKxqjsIoSETeXdoNNZ9PaseTbcDorfWxm3ld d4W/yESIL7GMA PGgR64/w6KRm&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(af2f5203658646c7891e1a30ae189bee)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=v7mgyaDXEmurtfQdTWT1bowUL5PDB7HR1DSIOwVlQH4=&c=DYkQ/Kk3sya1r5N77M3qDXFaDDMPFicgBhWdwNQbKsI36fnlk/IYkX4PaYdDdbyphUqo119gARznWfFyZKJxlahTsQLPZ xhcKK9Y1eCsz2LJLbVQHskGMkvoMoc26L2KiRXFVh8xS0sTZHQlB9QJjNYvzYz9KuHXXb2/6KIrdE=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(f2c0907fda37bf63d3d94edf3152b57e)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=rfXSgBZuzCjn0CmtCjdfMm/j5ibuoCihfQPsMMu/em4=&c=uXkqSR5 5vCczvPlgeXhY9mvli0m/MG0kBkb2FH0e4vicgSbFoBs0vS8DXLJJWpySoCiaeGapLdgtQQ2Wu0nLccl895pdIYoal89 WQ2iFMvFSU9Wo7FQjTQ9daJka7d&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi
(9c93b18dc09215098a8e27f6a0e875f2)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=XT4j7K4rqqWYC4q34bmf6raa16/JSCnXhNDu2RKW9N4=&c=Pi NoNyIEVwTdF5amxZyzEIvc/BLBW92v12 HbdmVY0QRmBTlz1TKcgWcf1AWFPtfJWMHfMzfv3UW1nsMZnhfjkRtie88RILk wMXNvY3Qqdgun2u9ot/aTiqiFmab0D&fallback_url=http://res.mshist.com/.../CandyCrushSaga.exe
(icreinstall_candycrushsaga.exe)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=kL2MSc5VUDiqEZt689ZsUVdjig/1MfCe05LFT9mcuQ0=&c=ej1AwLT0UyLrjyOlqfZARHGFtWWxsgXr a5OxtROBCa3YfXE0U8XuNkmMTvMcCHS gHM6meFCxEwvT4rREZv18NvfTqqYxnGUdjUbv2REcbKXvveres Q3asxra3N2uakeUt9Q80S60enCZv1h0U27iv3VIqmZ5c1OzIgUFPmpU=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe
(icreinstall_snapchat.exe)
1 / 68 (PUP)
http://www.nowtagheart.com/c?x=AgeUdNNAtymejwtobgZ /9IJVO5mjE53C2YM OA83X4=&c=aAi8ECv v9JrF01Qy9jeIw6AfIS9rnA4lBnu xvrNrUPcr6owZGkbQy0XeMIlAlfAh57QyZF nd8Ctz45y4doZIfQnXKwNXLRVXDoOzHDcEpotl6j2rTuL93f4ADmRRY&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe
(5365780cccd91cddce6e24addc931d8a)
Network Communications
The following 23 files have been seen to comunicate with www.nowtagheart.com in live environments.
TCP »
52.38.209.219
:80
rlvknlg.exe (Relevant-Knowledge by TMRG)
TCP »
52.33.46.229
:80
UCBrowser.exe (UC Browser by UCWeb)
TCP »
52.33.46.229
:80
browserairexec.exe (BrowserAir by Goobzo)
TCP »
52.38.209.219
:80
UCBrowser.exe (UC Browser by UCWeb)
TCP »
52.38.209.219
:80
browserairexec.exe (BrowserAir by Goobzo)
TCP »
52.24.26.116
:443
online-guardian-v2.0.9.exe
TCP »
52.24.26.116
:443
online-guardian-v2.0.9.exe
TCP »
52.38.209.219
:80
browser.exe (Browser)
TCP »
52.33.46.229
:80
citrio.exe (Citrio by CatalinaGroup)
TCP »
52.33.46.229
:80
Client.exe
TCP »
52.24.26.116
:443
rlvknlg.exe (Relevant-Knowledge by TMRG)
TCP »
52.24.26.116
:443
036629fbd4864725737a8ba8fe7e8cd6.exe
TCP »
52.33.46.229
:80
ShopAtHome_BAC_Service.exe (by ShopAtHome.com)
TCP »
52.33.46.229
:80
rlvknlg.exe (Relevant-Knowledge by TMRG)
TCP »
52.33.46.229
:80
browserair.exe (BrowserAir by Goobzo)
TCP »
52.38.209.219
:80
3.9.0.128_20140916045038.exe (The KMPlayer by PandoraTV)
TCP »
52.38.209.219
:80
e5be.tmp
TCP »
52.24.26.116
:443
rlvknlg.exe (Relevant-Knowledge by TMRG)
TCP »
52.24.26.116
:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))
TCP »
52.38.209.219
:80
client.exe
Latest 20 of 59 files
X