Cotação de desconto para licenças múltiplas

Mudar de região

English Português
Banco de Dados de Ameaças Programas potencialmente indesejados eSpeedGames Start

eSpeedGames Start

Por GoldSparrow em Programas potencialmente indesejados
Traduzir Para:

Cartão de pontuação de ameaças

Nível da Ameaça: 100 % (Alto)
Computadores infectados: 2
Visto pela Primeira Vez: June 7, 2023
Visto pela Última Vez: March 6, 2026
SO (s) Afetados: Windows

O software do eSpeedGames Start é publicado pela espeedcheck.com no Chrome.google.com/webstore/detail/espeedgames-start/fpogacjnhfdbdkdiccegfoinkddppenj. O aplicativo eSpeedGames Start é promovido como sendo capaz de fornecer aos internautas uma rápida experiência clique e visita via Cantstopplaying.com. O programa eSpeedGames Start é embalado como uma extensão de navegador para o Google Chrome, que você pode instalar e usar gratuitamente. O aplicativo pode modificar as suas novas configurações de página de guia no Chrome e oferecer links para jogos no Cantstopplaying.com. A nova guia com o eSpeedGames Start inclui uma caixa de pesquisa alimentada pelo Searchalgo.com que é um agregador de pesquisas associado a casos de seqüestro de navegador no passado. As operações de pesquisa realizadas através do eSpeedGames Start New Tab desencadeiam um redirecionamento do navegador via Games.searchalgo.com para o Search.yahoo.com. O mesmo portão de redirecionamento é usado pela mixGames Search, GamesMuze, iGames Search e gamesZone Search também. A instalação do aplicativo do eSpeedGames Start significa que você optou por conceder-lhe os seguintes privilégios:

  • Ler e alterar todos os seus dados on-line.
  • Substituir a página que você vê ao abrir uma nova guia.

A extensão de navegador eSpeedGames Start do espeedcheck.com é reconhecida como um Programa Potencialmente Indesejado (PPI), que coleta estatísticas de uso da Web para ajudar a empresa por trás do Searchalgo.com a coletar receitas oriundas de anúncios personalizados no Yahoo. Você pode querer saber que as funções do eSpeedGames Start funcionam da mesma forma que muitas extensões publicadas pela Medianetnow.com, Mymedianet.now, Superappbox.com, Mixplugin.com, Ienjoyapps.com, Bettersearchtools.com, Theappjunkies.com, Bettersearchtools.com, Goamuze.com, Playmediacenter.com, Myappline.com, Searchalgo.com, Friendlyappz.com, Myappline.com, Getappsonline.com, Playmediacenter.com, Iezbrowsing.com, Friendlyappz.com, Espeedcheck.com e Iezbrowsing.com na Loja Virtual do Chrome. O eSpeedGames Start tem o mesmo estilo de marketing e um código muito similar aos dos seguintes produtos, que devem ser produtos de empresas não relacionadas:

  • gamesPro Search by Mymedianetnow.com and Chrome.google.com/webstore/detail/gamespro-search/pgdbomlcailbhihagccohnopmpglcbji
  • getGames Start by Getapponline.com and Chrome.google.com/webstore/detail/getgames-start/koaejgofaegnifpbkeldkehnbnomldbd
  • gamingZone Start by Medianetnow.com and Chrome.google.com/webstore/detail/gamingzone-start/nhhboodmfnbbdoibnnikbchlocibjhbh
  • gamesJunkie Home by Theappjunkies.com and Chrome.google.com/webstore/detail/gamesjunkie-home/bfjillpbgjlgfhklcgbgkildcophgmlo
  • playNet Start by medianetnow.com and Chrome.google.com/webstore/detail/playnet-start/gnpphmgipfaoobhhkcfcbllckjjkddlg
  • browserGames Now by Njoyapps.com and Chrome.google.com/webstore/detail/browsergames-now/koadafnlijadikflcccnekcehikbdoe
  • browserGamer Now by Njoyapps.com and Chrome.google.com/webstore/detail/browsergamer-now/gllnfhbnopmjpifodjcgcbfcandfkjoj

Na verdade, parece haver uma conexão entre o Eanswers.com e o Searchalgo.com a julgar pelo uso de códigos quase idênticos e os redirecionamentos para versões personalizadas do Search.yahoo.com. Os comerciantes associados a esses domínios podem coletar dados como o histórico da Internet, o log de downloads e a lista de extensões de terceiros instaladas, para personalizar os comerciais exibidos através do Search.yahoo.com, Games.searchalgo.com e Eanswers.com. Os usuários de PC que podem não ficar à vontade compartilhando o seu histórico da Internet com uma extensa rede de editores de anúncios, podem optar por desinstalar a extensão eSpeedGames Start e ficar longe dos aplicativos mencionados acima. Você pode encontrar a Política de Privacidade e a EULA associadas ao espeedcheck.com no espeedcheck.com/privacy.php?cid=5049 and espeedcheck.com/eula.php?cid=5049.

Relatório de análise

Informação geral

Family Name: Filecoder.DDC Ransomware
Signature status: No Signature

Known Samples

MD5: c7806eed04288b3699bf4658a70fc344
SHA1: 66fe231345f2fae68758a40a556f323e40c2e4a0
SHA256: 5E31EEE8370FA389FC7425A6DF38C8D4A80E463F526EA292286B5AD406AB96A3
Tamanho do Arquivo: 2.65 MB, 2645803 bytes
MD5: 2f32ac0fe40ca637aba5b26e62ba6f9d
SHA1: 8b495a553aabd81a2ad7d4abf4de89639690c10a
SHA256: ACE8FFB6EB7508CF0BD62CE2A9096CBCEA314A15C7B67CDDA91D10D391E629EA
Tamanho do Arquivo: 2.62 MB, 2616427 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have resources
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • big overlay
  • dll
  • golang
  • x64

Block Information

Total Blocks: 1,085
Potentially Malicious Blocks: 2
Whitelisted Blocks: 1,083
Unknown Blocks: 0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Filecoder.DDC

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtFreeVirtualMemory
Show More
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN

Tendendo

Mais visto

Carregando...