Ransom.Win32.BLACKKINGDOM.A
別名:
Trojan.Python.Clipbanker (IKARUS); Trj/CI.A (PANDA)
プラットフォーム:
Windows
危険度:
ダメージ度:
感染力:
感染確認数:
情報漏えい:
マルウェアタイプ:
身代金要求型不正プログラム（ランサムウェア）
破壊活動の有無:
なし
暗号化:
なし
感染報告の有無 :
はい
概要
感染経路 インターネットからのダウンロード, 他のマルウェアからの作成
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
マルウェアは、感染コンピュータ上の特定の情報を収集します。
特定のファイル拡張子を持つファイルを暗号化します。 特定のフォルダ内のファイルを暗号化します。 身代金要求文書のファイルを作成します。
詳細
ファイルサイズ 11813169 bytes
タイプ EXE
メモリ常駐 なし
発見日 2020年3月3日
ペイロード 情報収集, メッセージボックスの表示, ファイルの暗号化, URLまたはIPアドレスに接続
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、以下のファイルを作成します。
- %User Temp%\_MEI{Random}\Crypto\Cipher\_ARC4.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_Salsa20.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_chacha20.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_aes.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_aesni.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_arc2.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_blowfish.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_cast.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_cbc.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_cfb.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_ctr.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_des.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_des3.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_ecb.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_eksblowfish.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_ocb.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Cipher\_raw_ofb.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_BLAKE2b.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_BLAKE2s.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_MD2.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_MD4.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_MD5.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_RIPEMD160.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_SHA1.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_SHA224.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_SHA256.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_SHA384.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_SHA512.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_ghash_clmul.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_ghash_portable.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_keccak.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Hash\_poly1305.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Math\_modexp.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Protocol\_scrypt.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\PublicKey\_ec_ws.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Util\_cpuid_c.cp38-win32.pyd
- %User Temp%\_MEI{Random}\Crypto\Util\_strxor.cp38-win32.pyd
- %User Temp%\_MEI{Random}\PIL\_imaging.cp38-win32.pyd
- %User Temp%\_MEI{Random}\PIL\_imagingtk.cp38-win32.pyd
- %User Temp%\_MEI{Random}\PIL\_webp.cp38-win32.pyd
- %User Temp%\_MEI{Random}\VCRUNTIME140.dll
- %User Temp%\_MEI{Random}\_asyncio.pyd
- %User Temp%\_MEI{Random}\_bz2.pyd
- %User Temp%\_MEI{Random}\_ctypes.pyd
- %User Temp%\_MEI{Random}\_decimal.pyd
- %User Temp%\_MEI{Random}\_elementtree.pyd
- %User Temp%\_MEI{Random}\_hashlib.pyd
- %User Temp%\_MEI{Random}\_lzma.pyd
- %User Temp%\_MEI{Random}\_multiprocessing.pyd
- %User Temp%\_MEI{Random}\_overlapped.pyd
- %User Temp%\_MEI{Random}\_queue.pyd
- %User Temp%\_MEI{Random}\_socket.pyd
- %User Temp%\_MEI{Random}\_ssl.pyd
- %User Temp%\_MEI{Random}\_testcapi.pyd
- %User Temp%\_MEI{Random}\_tkinter.pyd
- %User Temp%\_MEI{Random}\libcrypto-1_1.dll
- %User Temp%\_MEI{Random}\libffi-7.dll
- %User Temp%\_MEI{Random}\libssl-1_1.dll
- %User Temp%\_MEI{Random}\payload.exe.manifest
- %User Temp%\_MEI{Random}\pyexpat.pyd
- %User Temp%\_MEI{Random}\python38.dll
- %User Temp%\_MEI{Random}\select.pyd
- %User Temp%\_MEI{Random}\tcl86t.dll
- %User Temp%\_MEI{Random}\tk86t.dll
- %User Temp%\_MEI{Random}\unicodedata.pyd
- %User Temp%\_MEI{Random}\Include\pyconfig.h
- %User Temp%\_MEI{Random}\base_library.zip
- %User Temp%\_MEI{Random}\lib2to3\Grammar.txt
- %User Temp%\_MEI{Random}\lib2to3\Grammar3.8.1.final.0.pickle
- %User Temp%\_MEI{Random}\lib2to3\PatternGrammar.txt
- %User Temp%\_MEI{Random}\lib2to3\PatternGrammar3.8.1.final.0.pickle
- %User Temp%\_MEI{Random}\lib2to3\tests\data\README
- %User Temp%\_MEI{Random}\tcl\auto.tcl
- %User Temp%\_MEI{Random}\tcl\clock.tcl
- %User Temp%\_MEI{Random}\tcl\encoding\ascii.enc
- %User Temp%\_MEI{Random}\tcl\encoding\big5.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1250.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1251.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1252.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1253.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1254.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1255.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1256.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1257.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp1258.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp437.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp737.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp775.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp850.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp852.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp855.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp857.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp860.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp861.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp862.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp863.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp864.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp865.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp866.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp869.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp874.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp932.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp936.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp949.enc
- %User Temp%\_MEI{Random}\tcl\encoding\cp950.enc
- %User Temp%\_MEI{Random}\tcl\encoding\dingbats.enc
- %User Temp%\_MEI{Random}\tcl\encoding\ebcdic.enc
- %User Temp%\_MEI{Random}\tcl\encoding\euc-cn.enc
- %User Temp%\_MEI{Random}\tcl\encoding\euc-jp.enc
- %User Temp%\_MEI{Random}\tcl\encoding\euc-kr.enc
- %User Temp%\_MEI{Random}\tcl\encoding\gb12345.enc
- %User Temp%\_MEI{Random}\tcl\encoding\gb1988.enc
- %User Temp%\_MEI{Random}\tcl\encoding\gb2312-raw.enc
- %User Temp%\_MEI{Random}\tcl\encoding\gb2312.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso2022-jp.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso2022-kr.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso2022.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-1.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-10.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-13.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-14.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-15.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-16.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-2.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-3.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-4.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-5.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-6.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-7.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-8.enc
- %User Temp%\_MEI{Random}\tcl\encoding\iso8859-9.enc
- %User Temp%\_MEI{Random}\tcl\encoding\jis0201.enc
- %User Temp%\_MEI{Random}\tcl\encoding\jis0208.enc
- %User Temp%\_MEI{Random}\tcl\encoding\jis0212.enc
- %User Temp%\_MEI{Random}\tcl\encoding\koi8-r.enc
- %User Temp%\_MEI{Random}\tcl\encoding\koi8-u.enc
- %User Temp%\_MEI{Random}\tcl\encoding\ksc5601.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macCentEuro.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macCroatian.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macCyrillic.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macDingbats.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macGreek.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macIceland.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macJapan.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macRoman.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macRomania.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macThai.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macTurkish.enc
- %User Temp%\_MEI{Random}\tcl\encoding\macUkraine.enc
- %User Temp%\_MEI{Random}\tcl\encoding\shiftjis.enc
- %User Temp%\_MEI{Random}\tcl\encoding\symbol.enc
- %User Temp%\_MEI{Random}\tcl\encoding\tis-620.enc
- %User Temp%\_MEI{Random}\tcl\history.tcl
- %User Temp%\_MEI{Random}\tcl\http1.0\http.tcl
- %User Temp%\_MEI{Random}\tcl\http1.0\pkgIndex.tcl
- %User Temp%\_MEI{Random}\tcl\init.tcl
- %User Temp%\_MEI{Random}\tcl\msgs\af.msg
- %User Temp%\_MEI{Random}\tcl\msgs\af_za.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ar.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ar_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ar_jo.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ar_lb.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ar_sy.msg
- %User Temp%\_MEI{Random}\tcl\msgs\be.msg
- %User Temp%\_MEI{Random}\tcl\msgs\bg.msg
- %User Temp%\_MEI{Random}\tcl\msgs\bn.msg
- %User Temp%\_MEI{Random}\tcl\msgs\bn_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ca.msg
- %User Temp%\_MEI{Random}\tcl\msgs\cs.msg
- %User Temp%\_MEI{Random}\tcl\msgs\da.msg
- %User Temp%\_MEI{Random}\tcl\msgs\de.msg
- %User Temp%\_MEI{Random}\tcl\msgs\de_at.msg
- %User Temp%\_MEI{Random}\tcl\msgs\de_be.msg
- %User Temp%\_MEI{Random}\tcl\msgs\el.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_au.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_be.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_bw.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_ca.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_gb.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_hk.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_ie.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_nz.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_ph.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_sg.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_za.msg
- %User Temp%\_MEI{Random}\tcl\msgs\en_zw.msg
- %User Temp%\_MEI{Random}\tcl\msgs\eo.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_ar.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_bo.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_cl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_co.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_cr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_do.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_ec.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_gt.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_hn.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_mx.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_ni.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_pa.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_pe.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_pr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_py.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_sv.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_uy.msg
- %User Temp%\_MEI{Random}\tcl\msgs\es_ve.msg
- %User Temp%\_MEI{Random}\tcl\msgs\et.msg
- %User Temp%\_MEI{Random}\tcl\msgs\eu.msg
- %User Temp%\_MEI{Random}\tcl\msgs\eu_es.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fa.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fa_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fa_ir.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fi.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fo.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fo_fo.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fr_be.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fr_ca.msg
- %User Temp%\_MEI{Random}\tcl\msgs\fr_ch.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ga.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ga_ie.msg
- %User Temp%\_MEI{Random}\tcl\msgs\gl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\gl_es.msg
- %User Temp%\_MEI{Random}\tcl\msgs\gv.msg
- %User Temp%\_MEI{Random}\tcl\msgs\gv_gb.msg
- %User Temp%\_MEI{Random}\tcl\msgs\he.msg
- %User Temp%\_MEI{Random}\tcl\msgs\hi.msg
- %User Temp%\_MEI{Random}\tcl\msgs\hi_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\hr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\hu.msg
- %User Temp%\_MEI{Random}\tcl\msgs\id.msg
- %User Temp%\_MEI{Random}\tcl\msgs\id_id.msg
- %User Temp%\_MEI{Random}\tcl\msgs\is.msg
- %User Temp%\_MEI{Random}\tcl\msgs\it.msg
- %User Temp%\_MEI{Random}\tcl\msgs\it_ch.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ja.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kl_gl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ko.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ko_kr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kok.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kok_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kw.msg
- %User Temp%\_MEI{Random}\tcl\msgs\kw_gb.msg
- %User Temp%\_MEI{Random}\tcl\msgs\lt.msg
- %User Temp%\_MEI{Random}\tcl\msgs\lv.msg
- %User Temp%\_MEI{Random}\tcl\msgs\mk.msg
- %User Temp%\_MEI{Random}\tcl\msgs\mr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\mr_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ms.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ms_my.msg
- %User Temp%\_MEI{Random}\tcl\msgs\mt.msg
- %User Temp%\_MEI{Random}\tcl\msgs\nb.msg
- %User Temp%\_MEI{Random}\tcl\msgs\nl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\nl_be.msg
- %User Temp%\_MEI{Random}\tcl\msgs\nn.msg
- %User Temp%\_MEI{Random}\tcl\msgs\pl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\pt.msg
- %User Temp%\_MEI{Random}\tcl\msgs\pt_br.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ro.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ru.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ru_ua.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sh.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sk.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sl.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sq.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sv.msg
- %User Temp%\_MEI{Random}\tcl\msgs\sw.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ta.msg
- %User Temp%\_MEI{Random}\tcl\msgs\ta_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\te.msg
- %User Temp%\_MEI{Random}\tcl\msgs\te_in.msg
- %User Temp%\_MEI{Random}\tcl\msgs\th.msg
- %User Temp%\_MEI{Random}\tcl\msgs\tr.msg
- %User Temp%\_MEI{Random}\tcl\msgs\uk.msg
- %User Temp%\_MEI{Random}\tcl\msgs\vi.msg
- %User Temp%\_MEI{Random}\tcl\msgs\zh.msg
- %User Temp%\_MEI{Random}\tcl\msgs\zh_cn.msg
- %User Temp%\_MEI{Random}\tcl\msgs\zh_hk.msg
- %User Temp%\_MEI{Random}\tcl\msgs\zh_sg.msg
- %User Temp%\_MEI{Random}\tcl\msgs\zh_tw.msg
- %User Temp%\_MEI{Random}\tcl\opt0.4\optparse.tcl
- %User Temp%\_MEI{Random}\tcl\opt0.4\pkgIndex.tcl
- %User Temp%\_MEI{Random}\tcl\package.tcl
- %User Temp%\_MEI{Random}\tcl\parray.tcl
- %User Temp%\_MEI{Random}\tcl\safe.tcl
- %User Temp%\_MEI{Random}\tcl\tclIndex
- %User Temp%\_MEI{Random}\tcl\tm.tcl
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Abidjan
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Accra
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Addis_Ababa
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Algiers
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Asmara
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Asmera
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Bamako
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Bangui
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Banjul
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Bissau
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Blantyre
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Brazzaville
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Bujumbura
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Cairo
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Casablanca
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Ceuta
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Conakry
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Dakar
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Dar_es_Salaam
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Djibouti
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Douala
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\El_Aaiun
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Freetown
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Gaborone
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Harare
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Johannesburg
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Juba
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Kampala
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Khartoum
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Kigali
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Kinshasa
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Lagos
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Libreville
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Lome
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Luanda
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Lubumbashi
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Lusaka
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Malabo
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Maputo
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Maseru
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Mbabane
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Mogadishu
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Monrovia
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Nairobi
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Ndjamena
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Niamey
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Nouakchott
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Ouagadougou
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Porto-Novo
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Sao_Tome
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Timbuktu
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Tripoli
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Tunis
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\Windhoek
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Adak
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Anchorage
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Anguilla
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Antigua
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Araguaina
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Buenos_Aires
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Catamarca
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\ComodRivadavia
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Cordoba
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Jujuy
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\La_Rioja
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Mendoza
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Rio_Gallegos
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Salta
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\San_Juan
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\San_Luis
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Tucuman
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Argentina\Ushuaia
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Aruba
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Asuncion
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Atikokan
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Atka
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Bahia
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Bahia_Banderas
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Barbados
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Belem
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Belize
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Blanc-Sablon
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Boa_Vista
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Bogota
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Boise
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Buenos_Aires
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cambridge_Bay
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Campo_Grande
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cancun
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Caracas
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Catamarca
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cayenne
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cayman
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Chicago
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Chihuahua
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Coral_Harbour
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cordoba
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Costa_Rica
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Creston
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Cuiaba
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Curacao
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Danmarkshavn
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Dawson
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Dawson_Creek
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Denver
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Detroit
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Dominica
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Edmonton
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Eirunepe
- %User Temp%\_MEI{Random}\tcl\tzdata\America\El_Salvador
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Ensenada
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Fort_Nelson
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Fort_Wayne
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Fortaleza
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Glace_Bay
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Godthab
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Goose_Bay
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Grand_Turk
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Grenada
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Guadeloupe
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Guatemala
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Guayaquil
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Guyana
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Halifax
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Havana
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Hermosillo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Indianapolis
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Knox
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Marengo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Petersburg
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Tell_City
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Vevay
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Vincennes
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indiana\Winamac
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Indianapolis
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Inuvik
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Iqaluit
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Jamaica
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Jujuy
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Juneau
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Kentucky\Louisville
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Kentucky\Monticello
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Knox_IN
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Kralendijk
- %User Temp%\_MEI{Random}\tcl\tzdata\America\La_Paz
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Lima
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Los_Angeles
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Louisville
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Lower_Princes
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Maceio
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Managua
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Manaus
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Marigot
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Martinique
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Matamoros
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Mazatlan
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Mendoza
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Menominee
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Merida
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Metlakatla
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Mexico_City
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Miquelon
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Moncton
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Monterrey
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Montevideo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Montreal
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Montserrat
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Nassau
- %User Temp%\_MEI{Random}\tcl\tzdata\America\New_York
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Nipigon
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Nome
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Noronha
- %User Temp%\_MEI{Random}\tcl\tzdata\America\North_Dakota\Beulah
- %User Temp%\_MEI{Random}\tcl\tzdata\America\North_Dakota\Center
- %User Temp%\_MEI{Random}\tcl\tzdata\America\North_Dakota\New_Salem
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Ojinaga
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Panama
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Pangnirtung
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Paramaribo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Phoenix
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Port-au-Prince
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Port_of_Spain
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Porto_Acre
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Porto_Velho
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Puerto_Rico
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Punta_Arenas
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Rainy_River
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Rankin_Inlet
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Recife
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Regina
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Resolute
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Rio_Branco
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Rosario
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Santa_Isabel
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Santarem
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Santiago
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Santo_Domingo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Sao_Paulo
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Scoresbysund
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Shiprock
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Sitka
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Barthelemy
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Johns
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Kitts
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Lucia
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Thomas
- %User Temp%\_MEI{Random}\tcl\tzdata\America\St_Vincent
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Swift_Current
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Tegucigalpa
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Thule
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Thunder_Bay
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Tijuana
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Toronto
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Tortola
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Vancouver
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Virgin
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Whitehorse
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Winnipeg
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Yakutat
- %User Temp%\_MEI{Random}\tcl\tzdata\America\Yellowknife
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Casey
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Davis
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\DumontDUrville
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Macquarie
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Mawson
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\McMurdo
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Palmer
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Rothera
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\South_Pole
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Syowa
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Troll
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\Vostok
- %User Temp%\_MEI{Random}\tcl\tzdata\Arctic\Longyearbyen
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Aden
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Almaty
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Amman
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Anadyr
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Aqtau
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Aqtobe
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ashgabat
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ashkhabad
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Atyrau
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Baghdad
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Bahrain
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Baku
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Bangkok
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Barnaul
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Beirut
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Bishkek
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Brunei
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Calcutta
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Chita
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Choibalsan
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Chongqing
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Chungking
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Colombo
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Dacca
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Damascus
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Dhaka
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Dili
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Dubai
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Dushanbe
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Famagusta
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Gaza
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Harbin
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Hebron
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ho_Chi_Minh
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Hong_Kong
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Hovd
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Irkutsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Istanbul
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Jakarta
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Jayapura
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Jerusalem
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kabul
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kamchatka
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Karachi
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kashgar
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kathmandu
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Katmandu
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Khandyga
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kolkata
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Krasnoyarsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kuala_Lumpur
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kuching
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Kuwait
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Macao
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Macau
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Magadan
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Makassar
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Manila
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Muscat
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Nicosia
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Novokuznetsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Novosibirsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Omsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Oral
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Phnom_Penh
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Pontianak
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Pyongyang
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Qatar
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Qyzylorda
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Rangoon
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Riyadh
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Saigon
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Sakhalin
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Samarkand
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Seoul
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Shanghai
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Singapore
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Srednekolymsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Taipei
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tashkent
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tbilisi
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tehran
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tel_Aviv
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Thimbu
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Thimphu
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tokyo
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Tomsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ujung_Pandang
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ulaanbaatar
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ulan_Bator
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Urumqi
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Ust-Nera
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Vientiane
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Vladivostok
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Yakutsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Yangon
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Yekaterinburg
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\Yerevan
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Azores
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Bermuda
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Canary
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Cape_Verde
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Faeroe
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Faroe
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Jan_Mayen
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Madeira
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Reykjavik
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\South_Georgia
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\St_Helena
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\Stanley
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\ACT
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Adelaide
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Brisbane
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Broken_Hill
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Canberra
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Currie
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Darwin
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Eucla
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Hobart
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\LHI
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Lindeman
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Lord_Howe
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Melbourne
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\NSW
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\North
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Perth
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Queensland
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\South
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Sydney
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Tasmania
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Victoria
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\West
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\Yancowinna
- %User Temp%\_MEI{Random}\tcl\tzdata\Brazil\Acre
- %User Temp%\_MEI{Random}\tcl\tzdata\Brazil\DeNoronha
- %User Temp%\_MEI{Random}\tcl\tzdata\Brazil\East
- %User Temp%\_MEI{Random}\tcl\tzdata\Brazil\West
- %User Temp%\_MEI{Random}\tcl\tzdata\CET
- %User Temp%\_MEI{Random}\tcl\tzdata\CST6CDT
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Atlantic
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Central
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\East-Saskatchewan
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Eastern
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Mountain
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Newfoundland
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Pacific
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Saskatchewan
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\Yukon
- %User Temp%\_MEI{Random}\tcl\tzdata\Chile\Continental
- %User Temp%\_MEI{Random}\tcl\tzdata\Chile\EasterIsland
- %User Temp%\_MEI{Random}\tcl\tzdata\Cuba
- %User Temp%\_MEI{Random}\tcl\tzdata\EET
- %User Temp%\_MEI{Random}\tcl\tzdata\EST
- %User Temp%\_MEI{Random}\tcl\tzdata\EST5EDT
- %User Temp%\_MEI{Random}\tcl\tzdata\Egypt
- %User Temp%\_MEI{Random}\tcl\tzdata\Eire
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+0
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+1
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+10
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+11
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+12
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+2
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+3
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+4
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+5
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+6
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+7
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+8
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT+9
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-0
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-1
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-10
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-11
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-12
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-13
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-14
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-2
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-3
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-4
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-5
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-6
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-7
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-8
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT-9
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\GMT0
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\Greenwich
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\UCT
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\UTC
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\Universal
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\Zulu
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Amsterdam
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Andorra
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Astrakhan
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Athens
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Belfast
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Belgrade
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Berlin
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Bratislava
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Brussels
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Bucharest
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Budapest
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Busingen
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Chisinau
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Copenhagen
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Dublin
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Gibraltar
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Guernsey
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Helsinki
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Isle_of_Man
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Istanbul
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Jersey
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Kaliningrad
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Kiev
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Kirov
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Lisbon
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Ljubljana
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\London
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Luxembourg
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Madrid
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Malta
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Mariehamn
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Minsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Monaco
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Moscow
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Nicosia
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Oslo
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Paris
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Podgorica
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Prague
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Riga
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Rome
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Samara
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\San_Marino
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Sarajevo
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Saratov
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Simferopol
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Skopje
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Sofia
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Stockholm
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Tallinn
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Tirane
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Tiraspol
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Ulyanovsk
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Uzhgorod
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Vaduz
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Vatican
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Vienna
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Vilnius
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Volgograd
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Warsaw
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Zagreb
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Zaporozhye
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\Zurich
- %User Temp%\_MEI{Random}\tcl\tzdata\GB
- %User Temp%\_MEI{Random}\tcl\tzdata\GB-Eire
- %User Temp%\_MEI{Random}\tcl\tzdata\GMT
- %User Temp%\_MEI{Random}\tcl\tzdata\GMT+0
- %User Temp%\_MEI{Random}\tcl\tzdata\GMT-0
- %User Temp%\_MEI{Random}\tcl\tzdata\GMT0
- %User Temp%\_MEI{Random}\tcl\tzdata\Greenwich
- %User Temp%\_MEI{Random}\tcl\tzdata\HST
- %User Temp%\_MEI{Random}\tcl\tzdata\Hongkong
- %User Temp%\_MEI{Random}\tcl\tzdata\Iceland
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Antananarivo
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Chagos
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Christmas
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Cocos
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Comoro
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Kerguelen
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Mahe
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Maldives
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Mauritius
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Mayotte
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\Reunion
- %User Temp%\_MEI{Random}\tcl\tzdata\Iran
- %User Temp%\_MEI{Random}\tcl\tzdata\Israel
- %User Temp%\_MEI{Random}\tcl\tzdata\Jamaica
- %User Temp%\_MEI{Random}\tcl\tzdata\Japan
- %User Temp%\_MEI{Random}\tcl\tzdata\Kwajalein
- %User Temp%\_MEI{Random}\tcl\tzdata\Libya
- %User Temp%\_MEI{Random}\tcl\tzdata\MET
- %User Temp%\_MEI{Random}\tcl\tzdata\MST
- %User Temp%\_MEI{Random}\tcl\tzdata\MST7MDT
- %User Temp%\_MEI{Random}\tcl\tzdata\Mexico\BajaNorte
- %User Temp%\_MEI{Random}\tcl\tzdata\Mexico\BajaSur
- %User Temp%\_MEI{Random}\tcl\tzdata\Mexico\General
- %User Temp%\_MEI{Random}\tcl\tzdata\NZ
- %User Temp%\_MEI{Random}\tcl\tzdata\NZ-CHAT
- %User Temp%\_MEI{Random}\tcl\tzdata\Navajo
- %User Temp%\_MEI{Random}\tcl\tzdata\PRC
- %User Temp%\_MEI{Random}\tcl\tzdata\PST8PDT
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Apia
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Auckland
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Bougainville
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Chatham
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Chuuk
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Easter
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Efate
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Enderbury
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Fakaofo
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Fiji
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Funafuti
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Galapagos
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Gambier
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Guadalcanal
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Guam
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Honolulu
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Johnston
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Kiritimati
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Kosrae
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Kwajalein
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Majuro
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Marquesas
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Midway
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Nauru
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Niue
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Norfolk
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Noumea
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Pago_Pago
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Palau
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Pitcairn
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Pohnpei
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Ponape
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Port_Moresby
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Rarotonga
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Saipan
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Samoa
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Tahiti
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Tarawa
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Tongatapu
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Truk
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Wake
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Wallis
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\Yap
- %User Temp%\_MEI{Random}\tcl\tzdata\Poland
- %User Temp%\_MEI{Random}\tcl\tzdata\Portugal
- %User Temp%\_MEI{Random}\tcl\tzdata\ROC
- %User Temp%\_MEI{Random}\tcl\tzdata\ROK
- %User Temp%\_MEI{Random}\tcl\tzdata\Singapore
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\AST4
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\AST4ADT
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\CST6
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\CST6CDT
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\EST5
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\EST5EDT
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\HST10
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\MST7
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\MST7MDT
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\PST8
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\PST8PDT
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\YST9
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\YST9YDT
- %User Temp%\_MEI{Random}\tcl\tzdata\Turkey
- %User Temp%\_MEI{Random}\tcl\tzdata\UCT
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Alaska
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Aleutian
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Arizona
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Central
- %User Temp%\_MEI{Random}\tcl\tzdata\US\East-Indiana
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Eastern
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Hawaii
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Indiana-Starke
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Michigan
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Mountain
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Pacific
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Pacific-New
- %User Temp%\_MEI{Random}\tcl\tzdata\US\Samoa
- %User Temp%\_MEI{Random}\tcl\tzdata\UTC
- %User Temp%\_MEI{Random}\tcl\tzdata\Universal
- %User Temp%\_MEI{Random}\tcl\tzdata\W-SU
- %User Temp%\_MEI{Random}\tcl\tzdata\WET
- %User Temp%\_MEI{Random}\tcl\tzdata\Zulu
- %User Temp%\_MEI{Random}\tcl\word.tcl
- %User Temp%\_MEI{Random}\tk\bgerror.tcl
- %User Temp%\_MEI{Random}\tk\button.tcl
- %User Temp%\_MEI{Random}\tk\choosedir.tcl
- %User Temp%\_MEI{Random}\tk\clrpick.tcl
- %User Temp%\_MEI{Random}\tk\comdlg.tcl
- %User Temp%\_MEI{Random}\tk\console.tcl
- %User Temp%\_MEI{Random}\tk\dialog.tcl
- %User Temp%\_MEI{Random}\tk\entry.tcl
- %User Temp%\_MEI{Random}\tk\focus.tcl
- %User Temp%\_MEI{Random}\tk\fontchooser.tcl
- %User Temp%\_MEI{Random}\tk\iconlist.tcl
- %User Temp%\_MEI{Random}\tk\icons.tcl
- %User Temp%\_MEI{Random}\tk\images\README
- %User Temp%\_MEI{Random}\tk\images\logo.eps
- %User Temp%\_MEI{Random}\tk\images\logo100.gif
- %User Temp%\_MEI{Random}\tk\images\logo64.gif
- %User Temp%\_MEI{Random}\tk\images\logoLarge.gif
- %User Temp%\_MEI{Random}\tk\images\logoMed.gif
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo.eps
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo100.gif
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo150.gif
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo175.gif
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo200.gif
- %User Temp%\_MEI{Random}\tk\images\pwrdLogo75.gif
- %User Temp%\_MEI{Random}\tk\images\tai-ku.gif
- %User Temp%\_MEI{Random}\tk\license.terms
- %User Temp%\_MEI{Random}\tk\listbox.tcl
- %User Temp%\_MEI{Random}\tk\megawidget.tcl
- %User Temp%\_MEI{Random}\tk\menu.tcl
- %User Temp%\_MEI{Random}\tk\mkpsenc.tcl
- %User Temp%\_MEI{Random}\tk\msgbox.tcl
- %User Temp%\_MEI{Random}\tk\msgs\cs.msg
- %User Temp%\_MEI{Random}\tk\msgs\da.msg
- %User Temp%\_MEI{Random}\tk\msgs\de.msg
- %User Temp%\_MEI{Random}\tk\msgs\el.msg
- %User Temp%\_MEI{Random}\tk\msgs\en.msg
- %User Temp%\_MEI{Random}\tk\msgs\en_gb.msg
- %User Temp%\_MEI{Random}\tk\msgs\eo.msg
- %User Temp%\_MEI{Random}\tk\msgs\es.msg
- %User Temp%\_MEI{Random}\tk\msgs\fr.msg
- %User Temp%\_MEI{Random}\tk\msgs\hu.msg
- %User Temp%\_MEI{Random}\tk\msgs\it.msg
- %User Temp%\_MEI{Random}\tk\msgs\nl.msg
- %User Temp%\_MEI{Random}\tk\msgs\pl.msg
- %User Temp%\_MEI{Random}\tk\msgs\pt.msg
- %User Temp%\_MEI{Random}\tk\msgs\ru.msg
- %User Temp%\_MEI{Random}\tk\msgs\sv.msg
- %User Temp%\_MEI{Random}\tk\obsolete.tcl
- %User Temp%\_MEI{Random}\tk\optMenu.tcl
- %User Temp%\_MEI{Random}\tk\palette.tcl
- %User Temp%\_MEI{Random}\tk\panedwindow.tcl
- %User Temp%\_MEI{Random}\tk\pkgIndex.tcl
- %User Temp%\_MEI{Random}\tk\safetk.tcl
- %User Temp%\_MEI{Random}\tk\scale.tcl
- %User Temp%\_MEI{Random}\tk\scrlbar.tcl
- %User Temp%\_MEI{Random}\tk\spinbox.tcl
- %User Temp%\_MEI{Random}\tk\tclIndex
- %User Temp%\_MEI{Random}\tk\tearoff.tcl
- %User Temp%\_MEI{Random}\tk\text.tcl
- %User Temp%\_MEI{Random}\tk\tk.tcl
- %User Temp%\_MEI{Random}\tk\tkfbox.tcl
- %User Temp%\_MEI{Random}\tk\ttk\altTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\aquaTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\button.tcl
- %User Temp%\_MEI{Random}\tk\ttk\clamTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\classicTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\combobox.tcl
- %User Temp%\_MEI{Random}\tk\ttk\cursors.tcl
- %User Temp%\_MEI{Random}\tk\ttk\defaults.tcl
- %User Temp%\_MEI{Random}\tk\ttk\entry.tcl
- %User Temp%\_MEI{Random}\tk\ttk\fonts.tcl
- %User Temp%\_MEI{Random}\tk\ttk\menubutton.tcl
- %User Temp%\_MEI{Random}\tk\ttk\notebook.tcl
- %User Temp%\_MEI{Random}\tk\ttk\panedwindow.tcl
- %User Temp%\_MEI{Random}\tk\ttk\progress.tcl
- %User Temp%\_MEI{Random}\tk\ttk\scale.tcl
- %User Temp%\_MEI{Random}\tk\ttk\scrollbar.tcl
- %User Temp%\_MEI{Random}\tk\ttk\sizegrip.tcl
- %User Temp%\_MEI{Random}\tk\ttk\spinbox.tcl
- %User Temp%\_MEI{Random}\tk\ttk\treeview.tcl
- %User Temp%\_MEI{Random}\tk\ttk\ttk.tcl
- %User Temp%\_MEI{Random}\tk\ttk\utils.tcl
- %User Temp%\_MEI{Random}\tk\ttk\vistaTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\winTheme.tcl
- %User Temp%\_MEI{Random}\tk\ttk\xpTheme.tcl
- %User Temp%\_MEI{Random}\tk\unsupported.tcl
- %User Temp%\_MEI{Random}\tk\xmfbox.tcl
(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)
マルウェアは、以下のプロセスを追加します。
- {Malware Folder}\{Malware Name}.exe
マルウェアは、以下のフォルダを作成します。
- Folders:
- %User Temp%\_MEI{Random}\
- %User Temp%\_MEI{Random}\Crypto
- %User Temp%\_MEI{Random}\Crypto\Cipher\
- %User Temp%\_MEI{Random}\Crypto\Hash\
- %User Temp%\_MEI{Random}\Crypto\Math\
- %User Temp%\_MEI{Random}\Crypto\Protocol\
- %User Temp%\_MEI{Random}\Crypto\PublicKey\
- %User Temp%\_MEI{Random}\Crypto\Util\
- %User Temp%\_MEI{Random}\PIL\
- %User Temp%\_MEI{Random}\Include\
- %User Temp%\_MEI{Random}\lib2to3\
- %User Temp%\_MEI{Random}\lib2to3\tests\
- %User Temp%\_MEI{Random}\lib2to3\tests\data\
- %User Temp%\_MEI{Random}\tcl\
- %User Temp%\_MEI{Random}\tcl\encoding\
- %User Temp%\_MEI{Random}\tcl\http1.0\
- %User Temp%\_MEI{Random}\tcl\msgs\
- %User Temp%\_MEI{Random}\tcl\opt0.4\
- %User Temp%\_MEI{Random}\tcl\tzdata\
- %User Temp%\_MEI{Random}\tcl\tzdata\Africa\
- %User Temp%\_MEI{Random}\tcl\tzdata\America\
- %User Temp%\_MEI{Random}\tcl\tzdata\Antarctica\
- %User Temp%\_MEI{Random}\tcl\tzdata\Arctic\
- %User Temp%\_MEI{Random}\tcl\tzdata\Asia\
- %User Temp%\_MEI{Random}\tcl\tzdata\Atlantic\
- %User Temp%\_MEI{Random}\tcl\tzdata\Australia\
- %User Temp%\_MEI{Random}\tcl\tzdata\Brazil\
- %User Temp%\_MEI{Random}\tcl\tzdata\Canada\
- %User Temp%\_MEI{Random}\tcl\tzdata\Chile\
- %User Temp%\_MEI{Random}\tcl\tzdata\Etc\
- %User Temp%\_MEI{Random}\tcl\tzdata\Europe\
- %User Temp%\_MEI{Random}\tcl\tzdata\Indian\
- %User Temp%\_MEI{Random}\tcl\tzdata\Mexico\
- %User Temp%\_MEI{Random}\tcl\tzdata\Pacific\
- %User Temp%\_MEI{Random}\tcl\tzdata\SystemV\
- %User Temp%\_MEI{Random}\tcl\tzdata\US\
- %User Temp%\_MEI{Random}\tcl\word.tcl
- %User Temp%\_MEI{Random}\tk\
- %User Temp%\_MEI{Random}\tk\images\
- %User Temp%\_MEI{Random}\tk\msgs\
- %User Temp%\_MEI{Random}\tk\ttk\
(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)
情報漏えい
マルウェアは、感染コンピュータ上の以下の情報を収集します。
- IP Address
- OS Name
- Generated key
- Username
- Computer/Network Name
- Sends the following to: {BLOCKED}.{BLOCKED}.49.179:8989
その他
マルウェアは、以下を実行します。
- Show the following window after encryption:
ランサムウェアの不正活動
以下の拡張子を持つファイルを暗号化します：$$ DATA $$
- .txt
- .ppt
- .pptx
- .doc
- .docx
- .gif
- .jpg
- .png
- .ico
- .mp3
- .ogg
- .csv
- .xls
- .exe
- .ods
- .odt
- .kdbx
- .kdb
- .mp4
- .flv
- .iso
- .zip
- .tar
- .tar.gz
- .rar
- .backup
- .dump
- .docx
- .doc
- .bwg
- .jpeg
- .gzip
- .7z
- .key
- .config
マルウェアは、以下のディレクトリ内で確認されたファイルを暗号化します。
- Downloads
- Documents
- Pictures
- Music
- Desktop
- Onedrive
マルウェアは、暗号化されたファイルのファイル名に以下の拡張子を追加します。
- .DEMON
マルウェアが作成する以下のファイルは、脅迫状です。
- {Encrypted Folder}\README.txt
対応方法
対応検索エンジン: 9.850
初回 VSAPI パターンバージョン 15.942.05
初回 VSAPI パターンリリース日 2020年6月20日
VSAPI OPR パターンバージョン 15.943.00
VSAPI OPR パターンリリース日 2020年6月21日
手順 1
Windows 7、Windows 8、Windows 8.1、および Windows 10 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 2
このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム（OS）の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル／フォルダ／レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。
手順 3
以下のファイルを検索し削除します。
[ 詳細 ]
コンポーネントファイルが隠しファイル属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。 - {Encrypted Folder}\README.txt
手順 4
暗号化されたファイルをバックアップから復元します。
手順 5
最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Ransom.Win32.BLACKKINGDOM.A」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
ご利用はいかがでしたか？ アンケートにご協力ください