home

download.totalsystemcare.org

SafeBytes Software Inc.

Domain Information

This domain has been known to host and distribute adware as well as other potentially unwanted software. The hosted servers are located in Seattle, Washington within the United States which resides on the Amazon Technologies Inc. network. The domain uses the Amazon Cloudfront CDN service which utilizes a number of proxy IP Addresses (see below).
Registrar:
eNom, Inc.

Server location:
Washington, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc.,US

Root domain:
totalsystemcare.org

Whois:
2 totalsystemcare.org records

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Optional.Installer.V, PUP.Optional.Installer.AA, Win32.Generic.SafeBytesSoftware.Installer.Meta
100.00%

Trend Micro House Call
TROJ_GEN.F47V0516, TROJ_GEN.R00UH07C914, Suspicious_GEN.F47V0625, Suspici.B21A095B, Suspicious_GEN.F47V0712
29.41%

Dr.Web
BackDoor.Cybergate.1, Program.Unwanted.1015
17.65%

ESET NOD32
Detection.Undefined
11.76%

avast!
Win32:Adware-BLN [Adw], Win32:Malware-gen
11.76%

NANO AntiVirus
Trojan.Win32.Autoit.dbiolu
11.76%

MicroWorld eScan
Trojan.GenericKD.1602076
5.88%

nProtect
Trojan.GenericKD.1602076
5.88%

McAfee
Artemis!37BD65F12E99
5.88%

K7 AntiVirus
Riskware
5.88%

Norman
Suspicious_Gen4.FXLPV
5.88%

Kaspersky
Trojan-Dropper.Win32.FrauDrop
5.88%

Bitdefender
Trojan.GenericKD.1602076
5.88%

Lavasoft Ad-Aware
Trojan.GenericKD.1602076
5.88%

Sophos
Mal/Generic-S
5.88%

The domain download.totalsystemcare.org has been seen to resolve to the following 107 IP addresses.

52.85.131.6
server-52-85-131-6.iad53.r.cloudfront.net
May 20, 2016

52.85.131.61
server-52-85-131-61.iad53.r.cloudfront.net
May 16, 2016

52.85.131.188
server-52-85-131-188.iad53.r.cloudfront.net
May 16, 2016

52.85.131.181
server-52-85-131-181.iad53.r.cloudfront.net
May 16, 2016

52.85.131.160
server-52-85-131-160.iad53.r.cloudfront.net
May 16, 2016

52.85.131.147
server-52-85-131-147.iad53.r.cloudfront.net
May 16, 2016

52.85.131.144
server-52-85-131-144.iad53.r.cloudfront.net
May 16, 2016

52.85.131.66
server-52-85-131-66.iad53.r.cloudfront.net
May 16, 2016

52.85.131.217
server-52-85-131-217.iad53.r.cloudfront.net
April 14, 2016

52.85.131.162
server-52-85-131-162.iad53.r.cloudfront.net
April 14, 2016

52.85.131.157
server-52-85-131-157.iad53.r.cloudfront.net
April 14, 2016

52.85.131.139
server-52-85-131-139.iad53.r.cloudfront.net
April 14, 2016

52.85.131.121
server-52-85-131-121.iad53.r.cloudfront.net
April 14, 2016

52.85.131.60
server-52-85-131-60.iad53.r.cloudfront.net
April 14, 2016

52.85.131.54
server-52-85-131-54.iad53.r.cloudfront.net
April 14, 2016

52.85.131.21
server-52-85-131-21.iad53.r.cloudfront.net
April 14, 2016

54.230.102.182
server-54-230-102-182.iad2.r.cloudfront.net
March 3, 2016

54.230.102.149
server-54-230-102-149.iad2.r.cloudfront.net
March 3, 2016

54.230.102.121
server-54-230-102-121.iad2.r.cloudfront.net
March 3, 2016

54.230.102.110
server-54-230-102-110.iad2.r.cloudfront.net
March 3, 2016

54.230.102.42
server-54-230-102-42.iad2.r.cloudfront.net
March 3, 2016

54.230.102.41
server-54-230-102-41.iad2.r.cloudfront.net
March 3, 2016

54.230.102.33
server-54-230-102-33.iad2.r.cloudfront.net
March 3, 2016

54.230.102.13
server-54-230-102-13.iad2.r.cloudfront.net
March 3, 2016

54.192.195.178
server-54-192-195-178.iad53.r.cloudfront.net
February 22, 2016

54.192.195.161
server-54-192-195-161.iad53.r.cloudfront.net
February 22, 2016

54.192.195.95
server-54-192-195-95.iad53.r.cloudfront.net
February 22, 2016

54.192.195.89
server-54-192-195-89.iad53.r.cloudfront.net
February 22, 2016

54.192.195.227
server-54-192-195-227.iad53.r.cloudfront.net
February 22, 2016

54.192.195.221
server-54-192-195-221.iad53.r.cloudfront.net
February 22, 2016

 
Showing 30 of 107 IP Addresses

File downloads found at URLs served by download.totalsystemcare.org.

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (b1f0ec351793cee841d281d4b70104e9)

2 / 68      (PUP)
http://download.totalsystemcare.org/.../TotalSystemCare-Setup.exe  (3469e3b4d8577910a6892de2ce9d6e8d)

2 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (6760e92f742658cbea527fecab4a5d28)

1 / 68      (PUP)
http://download.totalsystemcare.org/.../TotalSystemCare-Setup.exe  (2e482d694cf82c2ebcb2adfd4a26d84a)

2 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (b589d6761ad541da9cc1210a701ca37e)

1 / 68      (PUP)
http://download.totalsystemcare.org/.../TotalSystemCare-Setup.exe  (45000922bb382d4763da06023e446317)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (456838f90f0c8b3f10da6f5af57fd3b5)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (00d95241bad0d61c86c386b0252b7348)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (9f75fe0f3a5bc906d1c46d274c1e54bb)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (9461b1dbaac857a036e9281ade45e125)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (e6dc56d2194c1a6bc67d680a930105ea)

3 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (fd25e10693417688b92e2be0b99a4cff)

2 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (fff62bcc5c6f8b0c9586d518d19d9097)

26 / 68    (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (cc21ab1d9bfe03d7bb2b3abb20a9a15d)

1 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup_FxCr.exe  (b794f91572404be87bb4bcc27488e28c)

3 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (26649f5c6a90d992f34dff9750ed5212)

3 / 68      (PUP)
http://download.totalsystemcare.org/TotalSystemCare-Setup.exe  (921f16c9c61b4ab772ecfc8214c8e51f)

The following 124 files have been seen to comunicate with download.totalsystemcare.org in live environments.

TCP » 54.192.55.150:80
browser.exe (Browser)

TCP » 54.192.195.197:443
online-guardian-v2.0.9.exe

TCP » 54.192.55.201:80
uvconverter.exe (TODO: <Product name> by TODO: <Company name>)

TCP » 54.192.55.146:80
uvconverter.exe (TODO: <Product name> by TODO: <Company name>)

TCP » 54.192.55.150:80
britches.exe (Britches)

TCP » 54.192.55.146:80
iedvutils.exe (Internet Explorer)

TCP » 54.192.55.146:80
gubed.exe

TCP » 54.192.55.150:80
saber.exe

TCP » 54.230.51.67:443
browserairexec.exe (BrowserAir by Goobzo)

TCP » 54.192.55.146:80
uvconverter.exe

TCP » 54.192.55.146:443
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 54.230.51.67:80
interhop.exe

TCP » 54.192.55.150:80
browser.exe (Browser)

TCP » 54.192.195.197:443
online-guardian-v2.0.9.exe

TCP » 54.230.50.162:443
citrio.exe (Citrio by CatalinaGroup)

TCP » 54.192.55.196:80
browser.exe (Browser)

TCP » 54.192.55.201:80
winzipersvc.exe (ExHelp by ExWzp Pvt)

TCP » 54.192.55.201:80
uvconverter.exe

TCP » 54.230.51.136:80
saber.exe

TCP » 54.230.51.67:80
mine-craft-setup.exe

 
Latest 20 of 151 files

URL:
http://download.totalsystemcare.org/

Network:
Amazon Cloudfront

Web server:
AmazonS3

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.