Popup - Predownload ! (marootrack.co)
A WhoIs lookup reveals the domain was registered by Buya Media Ltd in Isreal via GoDaddy on October 28, 2018 (updated January 6, 2021) - Whois marootrack.co
Popup redirects to TimeBucks, a “weekly Sweepstakes competition” with a total prize pool of $500.
A WhoIs lookup reveals the domain was registered via GoDaddy on April 18, 2014 (updated April 3, 2021) - Whois timebucks.com
VirusTotal - VirusTotal
Associated YouTube Account - TimeBucks - YouTube
Associated Email Address - [email protected]
According to user reports, the installer includes a bitcoin miner and a series of “crapware.”