PUA.Win32.OpenCandy.PAT

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のプロセスを追加します。

• %System%\mshta.exe "%User Temp%\HYD815F.tmp.1579414021\HTA\index.hta?utorrent" "{malware file path and name}" /LOG "%User Temp%\HYD815F.tmp.1579414021\index.hta.log" /PID "2008" /CID "hNrcE4HlNcdcvzio" /VERSION "109682639" /OS "6.1" /BROWSERS "\"%System Root%\Program Files\Mozilla Firefox\firefox.exe\",\"%Program Files%\Google\Chrome\Application\chrome.exe\",%System Root%\Program Files\Internet Explorer\iexplore.exe,\"%System Root%\Program Files\VMware\VMware Tools\VMwareHostOpen.exe\" --default http" /ARCHITECTURE "64" /LANG "en" /USERNAME "{username}" /SID "S-1-5-21-2407829820-1079796033-203259571-500" /CLIENT "utorrent"
• %User Temp%\utt1FB2.tmp.exe /cnid "903578" /hp /ntp_ie /wait /dsie /dsff
• uTorrent.exe /NOINSTALL /BRINGTOFRONT
• "%System%\cscript.exe" "shell_scripts/check_if_cscript_is_working.js"
• cscript "shell_scripts/check_if_cscript_is_working.js"
• "%System%\PING.EXE" 8.8.8.8 -n 2 -w 500
• ping 8.8.8.8 -n 2 -w 500
• "%System%\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.{BLOCKED}0.XYZ.bench.utorrent.com/e?{random characters}"
• cscript shell_scripts/shell_ping_after_close.js "http://i-50.{BLOCKED}0.XYZ.bench.utorrent.com/e?{random characters}"
• "%User Temp%\~sp2464.tmp" /cnid "903578" /hp /ntp_ie /wait /dsie /dsff /S

プログラムは、以下のフォルダを作成します。

• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n
• %Application Data%\uTorrent\updates
• %User Temp%\HYD815F.tmp.1579414021\HTA\styles
• %User Temp%\HYD815F.tmp.1579414021\HTA
• %User Temp%\HYD815F.tmp.1579414021\HTA\images
• %User Temp%\HYD815F.tmp.1579414021\HTA\shell_scripts
• %AppDataLocal%\{B5F70934-5E12-42d2-882D-62D42EA1FA67}
• %Application Data%\uTorrent\share
• %Application Data%\uTorrent\ie
• %User Temp%\HYD815F.tmp.1579414021
• %Application Data%\uTorrent
• %Application Data%\uTorrent\apps
• %Application Data%\uTorrent\dlimagecache
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。)

自動実行方法

プログラムは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
uTorrent = "%Application Data%\uTorrent\uTorrent.exe /MINIMIZED"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SMSetup = "{random characters}"

他のシステム変更

プログラムは、以下のファイルを削除します。

• %User Temp%\ADKAppsOfferManager.dll
• %Application Data%\uTorrent\apps\plus.btapp.18614.tmp
• %Application Data%\uTorrent\apps\featuredContent.btapp.18614.tmp
• %User Temp%\BunndleOfferManager.dll
• %Application Data%\uTorrent\apps\player.btapp.18614.tmp
• %Application Data%\uTorrent\apps\welcome-upsell.btapp.18614.tmp

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。)

プログラムは、以下のフォルダを削除します。

• %User Temp%\nso2388.tmp

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

プログラムは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Classes\
FalconBetaAccount
remote_access_client_id = "2490171132"

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferProvider = ""

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferName = ""

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferAccepted = "0"

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
OfferViaCAU = "0"

HKEY_CURRENT_USER\Software\BitTorrent
computerID = " cA\x88\x84\xda\xdc\x13\x81\xe55\xc7\xbf8\xa8ar\xfa\xdf\x07?\x97"

HKEY_CURRENT_USER\Software\Classes\
.torrent
(Default) = "uTorrent"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "12"

HKEY_CURRENT_USER\Software\Classes\
.torrent
Content Type = "application/x-bittorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent
Extension = ".torrent"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent
Extension = ".torrent"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
uTorrent\Content Type
(Default) = "application/x-bittorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "13"

HKEY_CURRENT_USER\Software\Classes\
.torrent\OpenWithProgids
uTorrent = ""

HKEY_CURRENT_USER\Software\Classes\
.btsearch
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "14"

HKEY_CURRENT_USER\Software\Classes\
.btsearch
Content Type = "application/x-bittorrentsearchdescription+xml"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrentsearchdescription+xml
Extension = ".btsearch"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrentsearchdescription+xml
Extension = ".btsearch"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "15"

HKEY_CURRENT_USER\Software\Classes\
Magnet
(Default) = "Magnet URI"

HKEY_CURRENT_USER\Software\Classes\
Magnet
URL Protocol = ""

HKEY_CURRENT_USER\Software\Classes\
Magnet
Content Type = "application/x-magnet"

HKEY_CURRENT_USER\Software\Classes\
Magnet\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
Magnet\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
Magnet\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "16"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "17"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "18"

HKEY_CURRENT_USER\Software\Classes\
bittorrent
(Default) = "bittorrent URI"

HKEY_CURRENT_USER\Software\Classes\
bittorrent
URL Protocol = ""

HKEY_CURRENT_USER\Software\Classes\
bittorrent
Content Type = "application/x-bittorrent-protocol"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\shell\open\
command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
bittorrent\DefaultIcon
(Default) = "%Application Data%\uTorrent\maindoc.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "19"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "20"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "21"

HKEY_CURRENT_USER\Software\Classes\
.btapp
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "22"

HKEY_CURRENT_USER\Software\Classes\
.btapp
Content Type = "application/x-bittorrent-app"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-app
Extension = ".btapp"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-app
Extension = ".btapp"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "23"

HKEY_CURRENT_USER\Software\Classes\
.btskin
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "24"

HKEY_CURRENT_USER\Software\Classes\
.btskin
Content Type = "application/x-bittorrent-skin"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-skin
Extension = ".btskin"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-skin
Extension = ".btskin"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "25"

HKEY_CURRENT_USER\Software\Classes\
.btinstall
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "26"

HKEY_CURRENT_USER\Software\Classes\
.btinstall
Content Type = "application/x-bittorrent-appinst"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-appinst
Extension = ".btinstall"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-appinst
Extension = ".btinstall"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "27"

HKEY_CURRENT_USER\Software\Classes\
.btkey
(Default) = "uTorrent"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "28"

HKEY_CURRENT_USER\Software\Classes\
.btkey
Content Type = "application/x-bittorrent-key"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
MIME\Database\Content Type\
application/x-bittorrent-key
Extension = ".btkey"

HKEY_CURRENT_USER\Software\Classes\
MIME\Database\Content Type\
application/x-bittorrent-key
Extension = ".btkey"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
explorer
GlobalAssocChangedCounter = "29"

HKEY_CURRENT_USER\Software\Classes\
.btsearch\OpenWithProgids
uTorrent = ""

HKEY_CURRENT_USER\Software\Classes\
Applications\uTorrent.exe\shell
(Default) = "open"

HKEY_CURRENT_USER\Software\Classes\
Applications\uTorrent.exe\shell\
open\command
(Default) = "%Application Data%\uTorrent\uTorrent.exe %1 /SHELLASSOC"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayIcon = "%Application Data%\uTorrent\uTorrent.exe,0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayName = "\xc2\xb5Torrent"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
DisplayVersion = "3.4.4.40911"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
UninstallString = "%Application Data%\uTorrent\uTorrent.exe /UNINSTALL"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
InstallLocation = "%Application Data%\uTorrent"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
VersionMajor = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
MajorVersion = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
VersionMinor = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
MinorVersion = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
NoModify = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
NoRepair = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
URLInfoAbout = "http://www.{BLOCKED}nt.com"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
uTorrent
Publisher = "BitTorrent Inc."

HKEY_CURRENT_USER\Software\BitTorrent\
uTorrent
Revision = "40911"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
cid2 = "8db427b7b79d72e5b03e6bf112530b31"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
WS_FF_AB = "https://search.{BLOCKED}o.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=524914&p="

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
WS_IE_AB = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
WS_FF_IB = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
WS_IE_IB = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
WS_GC_IB = "{random characters}"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
spid = "249"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
channelId = "903578"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
HP_IE = "https://search.{BLOCKED}o.com/?type=524914&fr=spigot-yhp-ie"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
HP_FF = "https://search.{BLOCKED}o.com/?type=524914&fr=spigot-yhp-ff"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
HP_GC = "https://search.{BLOCKED}o.com/?type=524914&fr=yo-yhp-ch"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
vloc20_brwrst = "2"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
vloc21_maxwait = "24"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
ISN = "0763504E16164134A67D6ED2F06CD889"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
ieds_ts = "1579414073"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
ffds_ts = "1579414073"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
gcds_ts = "1579414073"

HKEY_CURRENT_USER\Software\AppDataLow\
Software\Settings Manager
ts_brwrst = "1579414073"

作成活動

プログラムは、以下のファイルを作成します。

• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\es.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\ko.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\shell_scripts\shell_install_offer.js
• %User Temp%\HYD815F.tmp.1579414021\HTA\shell_scripts\shell_ping_after_close.js
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts\uninstall.js
• %Application Data%\uTorrent\settings.dat.new
• %User Temp%\HYD815F.tmp.1579414021\HTA\images\loading.gif
• %Application Data%\uTorrent\apps\welcome-upsell.btapp
• %AppDataLocal%\GDIPFONTCACHEV1.DAT
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts\common.js
• %User Temp%\HYD815F.tmp.1579414021\index.hta.log
• %Application Data%\uTorrent\toolbar_offer.benc
• %Application Data%\uTorrent\toolbar.benc.new
• %User Temp%\HYD815F.tmp.1579414021\HTA\images\main_bittorrent.ico
• %Application Data%\uTorrent\ie\ie.1579414942.tmp
• %Application Data%\uTorrent\apps\plus.btapp
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\it.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts\install.js
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\en.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\shell_scripts\check_if_cscript_is_working.js
• %User Temp%\HYD815F.tmp.1579414021\HTA\uninstall.hta
• %Desktop%\xc2\xb5Torrent.lnk
• %Application Data%\uTorrent\apps\featuredContent.btapp
• %User Temp%\HYD815F.tmp.1579414021\HTA\install.1579414021.zip
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\fr.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts\es5-shim.js
• %Application Data%\uTorrent\toolbar.benc
• %User Temp%\utt1FB2.tmp.exe
• %User Temp%\yahoo_ie.xml
• %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
• %Application Data%\uTorrent\settings.dat
• %Application Data%\uTorrent\apps\player.btapp.new
• %User Temp%\uttEE06.tmp.new
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\ru.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\images\bt_icon_48px.png
• %Application Data%\uTorrent\uTorrent.exe
• %Application Data%\uTorrent\settings.dat.old
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\pt.json
• %Application Data%\uTorrent\maindoc.ico
• %User Temp%\uttEE06.tmp.old
• %User Temp%\HYD815F.tmp.1579414021\HTA\images\main_utorrent.ico
• %Application Data%\uTorrent\apps\plus.btapp.new
• %User Temp%\HYD815F.tmp.1579414021\HTA\styles\common.css
• %Application Data%\uTorrent\toolbar.benc.old
• %Application Data%\uTorrent\apps\welcome-upsell.btapp.new
• %Application Data%\uTorrent\ie\ie.1579414073.tmp
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\de.json
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\xc2\xb5Torrent.lnk
• %Start Menu%\xc2\xb5Torrent.lnk
• %Application Data%\uTorrent\apps\featuredContent.btapp.new
• %Application Data%\uTorrent\apps\player.btapp
• %User Temp%\HYD815F.tmp.1579414021\HTA\i18n\br.json
• %User Temp%\HYD815F.tmp.1579414021\HTA\scripts\initialize.js
• %User Temp%\HYD815F.tmp.1579414021\HTA\styles\installer.css
• %User Temp%\HYD815F.tmp.1579414021\HTA\images\main_icon.png
• %Application Data%\uTorrent\updates.dat
• %User Temp%\HYD815F.tmp.1579414021\HTA\index.hta
• %Application Data%\uTorrent\updates\3.4.4_40911.exe

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %AppDataLocal%フォルダは、ローカルアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local" です。. %Desktop%フォルダは、現在ログオンしているユーザのデスクトップです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Desktop" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\Desktop" です。. %Start Menu%フォルダは、現在ログオンしているユーザのスタートメニューフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu" です。また、Windows Vista、7、8、8.1、2008(64-bit)、012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。)

その他

プログラムは、以下の不正なWebサイトにアクセスします。

• http://download-lb.{BLOCKED}nt.com/{random path}
• http://i-21.{BLOCKED}1.ut.bench.utorrent.com/e?i=21
• http://update.{BLOCKED}nt.com/installoffer.php?{random characters}
• http://update.{BLOCKED}nt.li/installstats.php?{random characters}
• http://www.{BLOCKED}serbar.com/images/pixel.gif?tb=1&cnid=903578
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/player.btapp
• http://apps.{BLOCKED}rent.com/utorrent-onboarding/welcome-upsell.btapp
• http://utclient.{BLOCKED}nt.com/pro/{BLOCKED}nt/index.html
• http://bundles.{BLOCKED}rent.com/onboarding/utorrent?{random characters}
• http://now.{BLOCKED}t.co/onboarding/utorrent
• http://llsw.{BLOCKED}ad3.utorrent.com/offers/SMStub-en-20150508.exe
• http://now.{BLOCKED}t.co/inclient
• http://update.{BLOCKED}nt.li/updatestats.php?{random characters}
• http://update2.{BLOCKED}serbar.com/kits/sds/update.xml
• http://www.{BLOCKED}adnetworkhost.com/kits/sds/update.xml
• http://update.{BLOCKED}adnetworkhost.com/kits/sds/SMSetup.exe
• http://{BLOCKED}nt.com/download/langpacks/dl.php?{random characters}
• http://www.{BLOCKED}nt.com/download/langpacks/dl.php?{random characters}
• http://www.{BLOCKED}nt.com/scripts/dl.php?{random characters}
• http://cdn.{BLOCKED}p.bittorrent.com/control/tags/ut.json
• http://i-27.{BLOCKED}1.ut.bench.utorrent.com/e?i=27
• http://api.{BLOCKED}adnetworkhost.com/cgi/api.cgi/903578/0763504E16164134A67D6ED2F06CD889/vloc/40
• http://api.{BLOCKED}adnetworkhost.com/cgi/api.cgi/ping/40
• http://www.{BLOCKED}o.com/favicon.ico
• http://i-29.{BLOCKED}1.ut.bench.utorrent.com/e?i=29
• http://i-32.{BLOCKED}1.ut.bench.utorrent.com/e?i=32
• http://cdn.{BLOCKED}p.bittorrent.com/control/feature/tags/ut.json
• http://i-38.{BLOCKED}1.ut.bench.utorrent.com/e?i=38
• http://i-43.{BLOCKED}1.ut.bench.utorrent.com/e?i=43
• http://router.{BLOCKED}rent.com
• http://router.{BLOCKED}nt.com
• http://bench.{BLOCKED}nt.com
• http://update.{BLOCKED}rent.com
• http://video.{BLOCKED}v.com
• http://fonts.{BLOCKED}apis.com
• http://production-assets.{BLOCKED}e.media
• http://code.{BLOCKED}y.com
• http://www.{BLOCKED}-analytics.com
• http://js-agent.{BLOCKED}ic.com
• http://bam.{BLOCKED}a.net
• http://i-1006.{BLOCKED}0.ad.bench.utorrent.com
• http://www9.{BLOCKED}dserver.com
• http://sdk.{BLOCKED}y-center.org
• http://script.{BLOCKED}gg.com
• http://s3.{BLOCKED}aws.com
• http://api.{BLOCKED}y-center.org
• http://i-200-b-0-0-5-content-bundles-bench.{BLOCKED}nt.com
• http://img1.{BLOCKED}e.media
• {BLOCKED}.120.117
• {BLOCKED}.123.182
• {BLOCKED}.99.87
• {BLOCKED}.193.229
• {BLOCKED}8.202
• {BLOCKED}3.192
• {BLOCKED}.175.90
• {BLOCKED}.185.11
• {BLOCKED}145.138
• {BLOCKED}95.112
• {BLOCKED}115.181
• {BLOCKED}.135.244
• {BLOCKED}4.233
• {BLOCKED}.235.70
• {BLOCKED}.136.178
• {BLOCKED}.55.129
• {BLOCKED}.139.255
• {BLOCKED}.109.66
• {BLOCKED}33.195
• {BLOCKED}.217.3
• {BLOCKED}.210.102
• {BLOCKED}.17.177
• {BLOCKED}.216.188
• {BLOCKED}.93.83
• {BLOCKED}.243.60
• {BLOCKED}.110.200
• {BLOCKED}.84.49
• {BLOCKED}.192.133
• {BLOCKED}59.206
• {BLOCKED}.9.8
• {BLOCKED}.146.201
• {BLOCKED}25.160
• {BLOCKED}.253.25
• {BLOCKED}65.5
• {BLOCKED}.210.248
• {BLOCKED}.216.155
• {BLOCKED}63.243
• {BLOCKED}236.126
• {BLOCKED}.234.33
• {BLOCKED}.57.14
• {BLOCKED}.184.25
• {BLOCKED}180.214
• {BLOCKED}.151.137
• {BLOCKED}.120.142
• {BLOCKED}23.28
• {BLOCKED}4.41
• {BLOCKED}.7.214
• {BLOCKED}.112.231
• {BLOCKED}73.104
• {BLOCKED}.55.5
• {BLOCKED}167.37
• {BLOCKED}161.48
• {BLOCKED}47.90
• {BLOCKED}203.237
• {BLOCKED}.127.173
• {BLOCKED}.135.233
• {BLOCKED}.124.68
• {BLOCKED}.240
• {BLOCKED}187.90
• {BLOCKED}185.57
• {BLOCKED}7.218
• {BLOCKED}79.181
• {BLOCKED}7.13
• {BLOCKED}.156.131
• {BLOCKED}.102.41
• {BLOCKED}69.211
• {BLOCKED}43.78
• {BLOCKED}.143.226
• {BLOCKED}.143.222
• {BLOCKED}.140.128
• {BLOCKED}.104.146
• {BLOCKED}13.74
• {BLOCKED}.250.50
• {BLOCKED}.223.243
• {BLOCKED}37.148
• {BLOCKED}147.7
• {BLOCKED}.5.140
• {BLOCKED}.186.212
• {BLOCKED}.243.146
• {BLOCKED}.179.200
• {BLOCKED}.176.175
• {BLOCKED}.116.185
• {BLOCKED}170.146
• {BLOCKED}.252.139
• {BLOCKED}6.183.190
• {BLOCKED}3.71.140
• {BLOCKED}.123.2
• {BLOCKED}.200.30
• {BLOCKED}.163.254
• {BLOCKED}0.226.192
• {BLOCKED}1.118.19
• {BLOCKED}3.246.12
• {BLOCKED}.41.159
• {BLOCKED}8.154.174
• {BLOCKED}8.135.62
• {BLOCKED}.43.149
• {BLOCKED}8.51.34
• {BLOCKED}6.247.129
• {BLOCKED}.13.184
• {BLOCKED}.210.254
• {BLOCKED}0.64.30
• {BLOCKED}8.63.73
• {BLOCKED}35.183
• {BLOCKED}0.123.232
• {BLOCKED}.245.30
• {BLOCKED}.201.14
• {BLOCKED}4.227.194
• {BLOCKED}4.181.225
• {BLOCKED}4.179.2
• {BLOCKED}4.169.225
• {BLOCKED}.70.88
• {BLOCKED}3.3.232
• {BLOCKED}9.48.52
• {BLOCKED}1.74.15
• {BLOCKED}9.228.197
• {BLOCKED}1.10.4
• {BLOCKED}0.249.142
• {BLOCKED}.173.189
• {BLOCKED}.147.151
• {BLOCKED}.155.23
• {BLOCKED}5.25.146
• {BLOCKED}.57.11
• {BLOCKED}3.44.233
• {BLOCKED}.10.15
• {BLOCKED}.59.182
• {BLOCKED}.195.190
• {BLOCKED}.151.26
• {BLOCKED}.91.162
• {BLOCKED}.26.173
• {BLOCKED}8.166.169
• {BLOCKED}.23.247
• {BLOCKED}1.142.101
• {BLOCKED}.241.3
• {BLOCKED}5.169.118
• {BLOCKED}.98.169
• {BLOCKED}.193.106
• {BLOCKED}.170.203
• {BLOCKED}7.64.151
• {BLOCKED}.63.220
• {BLOCKED}12.216
• {BLOCKED}45.66
• {BLOCKED}0.226.90
• {BLOCKED}2.202.22
• {BLOCKED}174.118
• {BLOCKED}5.74.15
• {BLOCKED}8.191.87
• {BLOCKED}1.188.139
• {BLOCKED}1.147.77
• {BLOCKED}2.103.92
• {BLOCKED}7.153.229
• {BLOCKED}8.249.11
• {BLOCKED}.192.93
• {BLOCKED}7.239.27
• {BLOCKED}183.129
• {BLOCKED}2.126.172
• {BLOCKED}6.156.165
• {BLOCKED}7.21.106
• {BLOCKED}1.174.34
• {BLOCKED}.248.153
• {BLOCKED}0.160.139
• {BLOCKED}.205.93
• {BLOCKED}3.54.19
• {BLOCKED}0.22.223
• {BLOCKED}9.120.153
• {BLOCKED}.64.24
• {BLOCKED}6.120.155
• {BLOCKED}0.112.165
• {BLOCKED}6.131.192
• {BLOCKED}.134.62
• {BLOCKED}7.200.202
• {BLOCKED}.19.128
• {BLOCKED}1.8.202
• {BLOCKED}0.236.208
• {BLOCKED}.52.214
• {BLOCKED}7.173.66
• {BLOCKED}154.176
• {BLOCKED}26.12

このウイルス情報は、自動解析システムにより作成されました。