TROJ_KOVTER.AUSKKA

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

マルウェアは、実行後、自身を削除します。

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

• %Application Data%\manik
• %System Root%\_115796_
• %System Root%\59d2fbf9021bfbdb8394
• %System Root%\59d2fbf9021bfbdb8394\update

(註：%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.)

他のシステム変更

マルウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_CURRENT_USER\Software\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade

HKEY_LOCAL_MACHINE\SOFTWARE\663ACB6432A4EA7F09C7

HKEY_LOCAL_MACHINE\SOFTWARE\28243CCA71B18F1F6A56

マルウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
zojewbdazo = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
zojewbdazo = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate
DisableOSUpgrade = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade
ReservationsAllowed = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
ltpxeirzlt = "JD9DgcQ5ArQaaw=="

HKEY_CURRENT_USER\Software\qanz
ltpxeirzlt = "dTASj5RrVAjQ+A=="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
bjtkim = "dm0WjpFrV0d9G5NWX9SL3gxfN+qFzcI="

HKEY_CURRENT_USER\Software\qanz
bjtkim = "JThB3Z48UMPX9w3ngeIjxkWQ0VYe+d8="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
eljz = "dG1FjJBsUGM32ZgNoOc7YvQ="

HKEY_CURRENT_USER\Software\qanz
eljz = "IjxNgMBsAsAwwxxgkvIasc0="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
kqdg = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
kqdg = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\663ACB6432A4EA7F09C7
ACB12E141D1D9A4A = "ACB12E141D1D9A4A"

HKEY_LOCAL_MACHINE\SOFTWARE\28243CCA71B18F1F6A56
8A6551C5E98D01931 = "8A6551C5E98D01931"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "0"

マルウェアは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1206 = "0"

(註：変更前の上記レジストリ値は、「3」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1809 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1206 = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1809 = "3"

(註：変更前の上記レジストリ値は、「3」となります。)

マルウェアは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SOFTWARE

作成活動

マルウェアは、以下のファイルを作成します。

• %Application Data%\manik\manik.exe
• %User Temp%\WindowsXP-KB968930-x86-ENG.exe
• %System Root%\59d2fbf9021bfbdb8394\eventforwarding.adm
• %System Root%\59d2fbf9021bfbdb8394\windowsremotemanagement.adm
• %System Root%\59d2fbf9021bfbdb8394\windowsremoteshell.adm
• %System Root%\59d2fbf9021bfbdb8394\windowspowershellhelp.chm
• %System Root%\59d2fbf9021bfbdb8394\winrm.cmd
• %System Root%\59d2fbf9021bfbdb8394\compiledcomposition.microsoft.powershell.gpowershell.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.backgroundintelligenttransfer.management.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.backgroundintelligenttransfer.management.interop.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.backgroundintelligenttransfer.management.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.diagnostics.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.diagnostics.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.management.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.management.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.utility.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.utility.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.consolehost.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.consolehost.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.editor.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.editor.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.gpowershell.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.gpowershell.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.graphicalhost.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.graphicalhost.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.security.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.security.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.wsman.management.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.wsman.management.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\microsoft.wsman.runtime.dll
• %System Root%\59d2fbf9021bfbdb8394\powershell_ise.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\pspluginwkr.dll
• %System Root%\59d2fbf9021bfbdb8394\pwrshmsg.dll
• %System Root%\59d2fbf9021bfbdb8394\pwrshplugin.dll
• %System Root%\59d2fbf9021bfbdb8394\pwrshsip.dll
• %System Root%\59d2fbf9021bfbdb8394\spmsg.dll
• %System Root%\59d2fbf9021bfbdb8394\system.management.automation.dll
• %System Root%\59d2fbf9021bfbdb8394\system.management.automation.resources.dll
• %System Root%\59d2fbf9021bfbdb8394\wevtfwd.dll
• %System Root%\59d2fbf9021bfbdb8394\winrmprov.dll
• %System Root%\59d2fbf9021bfbdb8394\winrscmd.dll
• %System Root%\59d2fbf9021bfbdb8394\winrsmgr.dll
• %System Root%\59d2fbf9021bfbdb8394\winrssrv.dll
• %System Root%\59d2fbf9021bfbdb8394\wsmauto.dll
• %System Root%\59d2fbf9021bfbdb8394\wsmplpxy.dll
• %System Root%\59d2fbf9021bfbdb8394\wsmres.dll
• %System Root%\59d2fbf9021bfbdb8394\wsmsvc.dll
• %System Root%\59d2fbf9021bfbdb8394\wsmwmipl.dll
• %System Root%\59d2fbf9021bfbdb8394\powershell.exe
• %System Root%\59d2fbf9021bfbdb8394\powershell_ise.exe
• %System Root%\59d2fbf9021bfbdb8394\pscustomsetuputil.exe
• %System Root%\59d2fbf9021bfbdb8394\pssetupnativeutils.exe
• %System Root%\59d2fbf9021bfbdb8394\spuninst.exe
• %System Root%\59d2fbf9021bfbdb8394\spupdsvc.exe
• %System Root%\59d2fbf9021bfbdb8394\winrs.exe
• %System Root%\59d2fbf9021bfbdb8394\winrshost.exe
• %System Root%\59d2fbf9021bfbdb8394\wsmanhttpconfig.exe
• %System Root%\59d2fbf9021bfbdb8394\wsmprovhost.exe
• %System Root%\59d2fbf9021bfbdb8394\wtrinstaller.ico
• %System Root%\59d2fbf9021bfbdb8394\winrm.ini
• %System Root%\59d2fbf9021bfbdb8394\winrmprov.mof
• %System Root%\59d2fbf9021bfbdb8394\wsmauto.mof
• %System Root%\59d2fbf9021bfbdb8394\powershell.exe.mui
• %System Root%\59d2fbf9021bfbdb8394\profile.ps1
• %System Root%\59d2fbf9021bfbdb8394\bitstransfer.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\certificate.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\diagnostics.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\dotnettypes.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\filesystem.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\getevent.types.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\help.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\powershellcore.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\powershelltrace.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\registry.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\types.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\wsman.format.ps1xml
• %System Root%\59d2fbf9021bfbdb8394\bitstransfer.psd1
• %System Root%\59d2fbf9021bfbdb8394\importallmodules.psd1
• %System Root%\59d2fbf9021bfbdb8394\about_aliases.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_arithmetic_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_arrays.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_assignment_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_automatic_variables.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_bits_cmdlets.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_break.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_command_precedence.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_command_syntax.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_comment_based_help.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_commonparameters.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_comparison_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_continue.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_core_commands.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_data_sections.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_debuggers.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_do.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_environment_variables.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_escape_characters.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_eventlogs.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_execution_policies.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_for.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_foreach.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_format.ps1xml.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_functions.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_functions_advanced.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_functions_advanced_methods.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_functions_advanced_parameters.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_functions_cmdletbindingattribute.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_hash_tables.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_history.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_if.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_job_details.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_jobs.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_join.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_language_keywords.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_line_editing.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_locations.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_logical_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_methods.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_modules.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_objects.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_parameters.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_parsing.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_path_syntax.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_pipelines.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_preference_variables.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_profiles.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_prompts.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_properties.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_providers.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_pssession_details.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_pssessions.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_pssnapins.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_quoting_rules.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_redirection.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_ref.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_regular_expressions.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote_faq.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote_jobs.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote_output.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote_requirements.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_remote_troubleshooting.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_requires.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_reserved_words.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_return.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_scopes.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_script_blocks.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_script_internationalization.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_scripts.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_session_configurations.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_signing.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_special_characters.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_split.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_switch.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_throw.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_transactions.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_trap.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_try_catch_finally.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_type_operators.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_types.ps1xml.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_variables.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_while.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_wildcards.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_windows_powershell_2.0.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_windows_powershell_ise.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_wmi_cmdlets.help.txt
• %System Root%\59d2fbf9021bfbdb8394\about_ws-management_cmdlets.help.txt
• %System Root%\59d2fbf9021bfbdb8394\default.help.txt
• %System Root%\59d2fbf9021bfbdb8394\winrm.vbs
• %System Root%\59d2fbf9021bfbdb8394\microsoft.backgroundintelligenttransfer.management.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.diagnostics.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.management.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.commands.utility.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.consolehost.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.powershell.security.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\microsoft.wsman.management.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\system.management.automation.dll-help.xml
• %System Root%\59d2fbf9021bfbdb8394\wsmpty.xsl
• %System Root%\59d2fbf9021bfbdb8394\wsmtxt.xsl
• %System Root%\59d2fbf9021bfbdb8394\update\kb968930xp.cat
• %System Root%\59d2fbf9021bfbdb8394\update\spcustom.dll
• %System Root%\59d2fbf9021bfbdb8394\update\updspapi.dll
• %System Root%\59d2fbf9021bfbdb8394\update\update.exe
• %System Root%\59d2fbf9021bfbdb8394\update\update.inf
• %System Root%\59d2fbf9021bfbdb8394\update\eula.txt
• %System Root%\59d2fbf9021bfbdb8394\update\update.ver
• %System Root%\59d2fbf9021bfbdb8394\$shtdwn$.req

その他

マルウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}7.72.90
• http://{BLOCKED}7.72.90/{random path}
• {BLOCKED}55.252
• {BLOCKED}.216.199
• {BLOCKED}.127.83
• {BLOCKED}.23.49
• {BLOCKED}173.189
• {BLOCKED}.179.127
• {BLOCKED}.35.103
• {BLOCKED}2.249.12
• {BLOCKED}.195.251
• {BLOCKED}41.133
• {BLOCKED}.253.109
• {BLOCKED}.176.130
• {BLOCKED}5.65.37
• {BLOCKED}9.227.57
• {BLOCKED}2.204.95
• {BLOCKED}.2.28
• {BLOCKED}9.212.212
• {BLOCKED}6.149.136
• {BLOCKED}8.90.236
• {BLOCKED}123.2
• {BLOCKED}.203.56
• {BLOCKED}9.30.75
• {BLOCKED}8.233.143
• {BLOCKED}.123.151
• {BLOCKED}0.157.79
• {BLOCKED}.73.96
• {BLOCKED}9.7.9
• {BLOCKED}.242.184
• {BLOCKED}.197.200
• {BLOCKED}2.163.132
• {BLOCKED}182.133
• {BLOCKED}180.95
• {BLOCKED}238.64
• {BLOCKED}81.52
• {BLOCKED}.202.219
• {BLOCKED}7.136.132
• {BLOCKED}135.233
• {BLOCKED}2.113.148
• {BLOCKED}7.45.10
• {BLOCKED}.225.3
• {BLOCKED}.33.253
• {BLOCKED}0.157.59
• {BLOCKED}.3.214
• {BLOCKED}155.120
• {BLOCKED}6.101.63
• {BLOCKED}.73.165
• {BLOCKED}.67.254
• {BLOCKED}2.103.209
• {BLOCKED}120.192
• {BLOCKED}1.57.148
• {BLOCKED}64.168
• {BLOCKED}153.75
• {BLOCKED}5.131.115
• {BLOCKED}.207.209
• {BLOCKED}5.235.150
• {BLOCKED}.174.191
• {BLOCKED}.29.109
• {BLOCKED}.47.234
• {BLOCKED}12.142
• {BLOCKED}8.55.161
• {BLOCKED}.179.163
• {BLOCKED}3.101.212
• {BLOCKED}.91.81
• {BLOCKED}167.56
• {BLOCKED}.154.84
• {BLOCKED}.67.52
• {BLOCKED}43.63
• {BLOCKED}.19.53
• {BLOCKED}.252.45
• {BLOCKED}8.208.70
• {BLOCKED}208.25
• {BLOCKED}2.222.216
• {BLOCKED}.250.248
• {BLOCKED}.128.70
• {BLOCKED}.33.11
• {BLOCKED}8.72.31
• {BLOCKED}26.81
• {BLOCKED}7.37.182
• {BLOCKED}.222.204
• {BLOCKED}5.33.193
• {BLOCKED}7.136.172
• {BLOCKED}6.105.162
• {BLOCKED}.30.159
• {BLOCKED}.149.107
• {BLOCKED}4.31
• {BLOCKED}.180.38
• {BLOCKED}137.51
• {BLOCKED}.143.92
• {BLOCKED}.15.218
• {BLOCKED}.100.250
• {BLOCKED}163.181
• {BLOCKED}.152.195
• {BLOCKED}69.115
• {BLOCKED}3.239.171
• {BLOCKED}.141.16
• {BLOCKED}9.118.168
• {BLOCKED}1.27.21
• {BLOCKED}239.67
• {BLOCKED}2.246.8
• {BLOCKED}.95.95
• {BLOCKED}0.184.88
• {BLOCKED}.35.174
• {BLOCKED}95.83
• {BLOCKED}7.5.203
• {BLOCKED}.206.57
• {BLOCKED}231.198
• {BLOCKED}4.21.105
• {BLOCKED}3.49.12
• {BLOCKED}.158.103
• {BLOCKED}.19.154
• {BLOCKED}120.159
• {BLOCKED}127.98
• {BLOCKED}2.97.203
• {BLOCKED}2.202.173
• {BLOCKED}.90.69
• {BLOCKED}146.37
• {BLOCKED}.141.14
• {BLOCKED}4.137.57
• {BLOCKED}0.61.153
• {BLOCKED}7.99.241
• {BLOCKED}8.235.97
• {BLOCKED}.59.133
• {BLOCKED}188.40
• {BLOCKED}.188.214
• {BLOCKED}.150.133
• {BLOCKED}.28.213
• {BLOCKED}2.26.173
• {BLOCKED}219.40
• {BLOCKED}76.119
• {BLOCKED}94.111
• {BLOCKED}.81.236
• {BLOCKED}7.173.41
• {BLOCKED}4.179.34
• {BLOCKED}12.8
• {BLOCKED}6.191.173
• {BLOCKED}.126.173
• {BLOCKED}255.82
• {BLOCKED}0.44
• {BLOCKED}.194.14
• {BLOCKED}.246.188
• {BLOCKED}.64.71
• {BLOCKED}.239.211
• {BLOCKED}2.32
• {BLOCKED}43.146
• {BLOCKED}41.180
• {BLOCKED}6.216.220
• {BLOCKED}2.147.141
• {BLOCKED}.235.255
• {BLOCKED}4.77.134
• {BLOCKED}.3.96
• {BLOCKED}.8.157
• {BLOCKED}.6.168
• {BLOCKED}2.32.31
• {BLOCKED}5.41.241
• {BLOCKED}7.77.65
• {BLOCKED}2.10.133
• {BLOCKED}.167.128
• {BLOCKED}3.230.100
• {BLOCKED}.254.56
• {BLOCKED}197.114
• {BLOCKED}17.187
• {BLOCKED}0.178.236
• {BLOCKED}.235.211
• {BLOCKED}.104.34
• {BLOCKED}0.122.232
• {BLOCKED}141.35
• {BLOCKED}5.231.92
• {BLOCKED}.83.21
• {BLOCKED}1.179.188
• {BLOCKED}5.232.49
• {BLOCKED}6.155
• {BLOCKED}4.240.164
• {BLOCKED}.150.197
• {BLOCKED}.61.19
• {BLOCKED}.37.171
• {BLOCKED}2.156.48
• {BLOCKED}1.147.51
• {BLOCKED}.155.135
• {BLOCKED}5.245.81
• {BLOCKED}.147.48
• {BLOCKED}8.188.90
• {BLOCKED}3.85.175
• {BLOCKED}.192.149
• {BLOCKED}9.80.98
• {BLOCKED}5.56.95
• {BLOCKED}9.91.200
• {BLOCKED}6.247.201
• {BLOCKED}.199.31
• {BLOCKED}107.203
• {BLOCKED}.98.89
• {BLOCKED}.55.1
• {BLOCKED}.41.31
• {BLOCKED}71.184
• {BLOCKED}27.43
• {BLOCKED}7.95.254
• {BLOCKED}.67.42
• {BLOCKED}6.62.48
• {BLOCKED}0.8.73
• {BLOCKED}.133.59
• {BLOCKED}.207.106
• {BLOCKED}4.237.9
• {BLOCKED}.109.186
• {BLOCKED}3.251.77
• {BLOCKED}8.97.154
• {BLOCKED}.205.179
• {BLOCKED}.146.223
• {BLOCKED}0.59.43
• {BLOCKED}.135.132
• {BLOCKED}7.241.77
• {BLOCKED}3.88.129
• {BLOCKED}.1.252
• {BLOCKED}.239.143
• {BLOCKED}5.242.87
• {BLOCKED}.149.142
• {BLOCKED}.40.212
• {BLOCKED}.44.14
• {BLOCKED}.117.184
• {BLOCKED}.147.216
• {BLOCKED}.153.122
• {BLOCKED}21.78
• {BLOCKED}7.142.80
• {BLOCKED}.134.19
• {BLOCKED}179.120
• {BLOCKED}.141.221
• {BLOCKED}.132.129
• {BLOCKED}2.130.214
• {BLOCKED}.126.178
• {BLOCKED}.233.229
• {BLOCKED}.6.206
• {BLOCKED}.202.18
• {BLOCKED}112.41

マルウェアは、実行後、自身を削除します。

このウイルス情報は、自動解析システムにより作成されました。