TSPY_KOVTER.XXN

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

スパイウェアは、実行後、自身を削除します。

侵入方法

スパイウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

スパイウェアは、以下のフォルダを作成します。

• %Application Data%\etev
• %System Root%\_124609_
• %System Root%\71fd5c133715633609d3
• %System Root%\71fd5c133715633609d3\update

(註：%Application Data%フォルダは、Windows 2000、XP および Server 2003 の場合、通常 "C:\Documents and Settings\＜ユーザ名＞\Local Settings\Application Data"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming" です。.. %System Root%フォルダは、オペレーティングシステム(OS)が存在する場所で、いずれのOSでも通常、 "C:" です。.)

他のシステム変更

スパイウェアは、以下のレジストリキーを追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION

HKEY_CURRENT_USER\Software\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\qanz

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade

HKEY_LOCAL_MACHINE\SOFTWARE\291C11060679326D06

HKEY_LOCAL_MACHINE\SOFTWARE\7FCBF9DB3E470A2C

スパイウェアは、以下のレジストリ値を追加します。

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
regsvr32.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main\FeatureControl\
FEATURE_BROWSER_EMULATION
iexplore.exe = "22b8"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate
DisableOSUpgrade = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\WindowsUpdate\
OSUpgrade
ReservationsAllowed = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
ltpxeirzlt = "JTkW2sRpWaZ6Tw=="

HKEY_CURRENT_USER\Software\qanz
ltpxeirzlt = "dT9F3ZA+B179Qw=="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
bjtkim = "dmwS3JM+A4SMOSHUOjYSwN78+JxXVyQ="

HKEY_CURRENT_USER\Software\qanz
bjtkim = "cWlNiJVsU4f5agx9CnjnkYcbAeGZlWY="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
eljz = "czlMisJqVD8XauzLDagyQoI="

HKEY_CURRENT_USER\Software\qanz
eljz = "ITtGjJI+AmQd2ADgqrHR6e0="

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
zojewbdazo = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
zojewbdazo = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\qanz
kqdg = "{random characters}"

HKEY_CURRENT_USER\Software\qanz
kqdg = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\291C11060679326D06
82B43D6EA63CA28F3F8 = "82B43D6EA63CA28F3F8"

HKEY_LOCAL_MACHINE\SOFTWARE\7FCBF9DB3E470A2C
9124E9432478071521 = "9124E9432478071521"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Setup
LogLevel = "0"

スパイウェアは、以下のレジストリ値を変更します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1206 = "0"

(註：変更前の上記レジストリ値は、「3」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1809 = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1206 = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
2300 = "0"

(註：変更前の上記レジストリ値は、「1」となります。)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\1
1809 = "3"

(註：変更前の上記レジストリ値は、「3」となります。)

スパイウェアは、以下のレジストリキーを削除します。

HKEY_LOCAL_MACHINE\SOFTWARE

作成活動

スパイウェアは、以下のファイルを作成します。

• %Application Data%\etev\etev.exe
• %User Temp%\WindowsXP-KB968930-x86-ENG.exe
• %System Root%\71fd5c133715633609d3\eventforwarding.adm
• %System Root%\71fd5c133715633609d3\windowsremotemanagement.adm
• %System Root%\71fd5c133715633609d3\windowsremoteshell.adm
• %System Root%\71fd5c133715633609d3\windowspowershellhelp.chm
• %System Root%\71fd5c133715633609d3\winrm.cmd
• %System Root%\71fd5c133715633609d3\compiledcomposition.microsoft.powershell.gpowershell.dll
• %System Root%\71fd5c133715633609d3\microsoft.backgroundintelligenttransfer.management.dll
• %System Root%\71fd5c133715633609d3\microsoft.backgroundintelligenttransfer.management.interop.dll
• %System Root%\71fd5c133715633609d3\microsoft.backgroundintelligenttransfer.management.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.diagnostics.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.diagnostics.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.management.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.management.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.utility.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.utility.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.consolehost.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.consolehost.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.editor.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.editor.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.gpowershell.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.gpowershell.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.graphicalhost.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.graphicalhost.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.security.dll
• %System Root%\71fd5c133715633609d3\microsoft.powershell.security.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.wsman.management.dll
• %System Root%\71fd5c133715633609d3\microsoft.wsman.management.resources.dll
• %System Root%\71fd5c133715633609d3\microsoft.wsman.runtime.dll
• %System Root%\71fd5c133715633609d3\powershell_ise.resources.dll
• %System Root%\71fd5c133715633609d3\pspluginwkr.dll
• %System Root%\71fd5c133715633609d3\pwrshmsg.dll
• %System Root%\71fd5c133715633609d3\pwrshplugin.dll
• %System Root%\71fd5c133715633609d3\pwrshsip.dll
• %System Root%\71fd5c133715633609d3\spmsg.dll
• %System Root%\71fd5c133715633609d3\system.management.automation.dll
• %System Root%\71fd5c133715633609d3\system.management.automation.resources.dll
• %System Root%\71fd5c133715633609d3\wevtfwd.dll
• %System Root%\71fd5c133715633609d3\winrmprov.dll
• %System Root%\71fd5c133715633609d3\winrscmd.dll
• %System Root%\71fd5c133715633609d3\winrsmgr.dll
• %System Root%\71fd5c133715633609d3\winrssrv.dll
• %System Root%\71fd5c133715633609d3\wsmauto.dll
• %System Root%\71fd5c133715633609d3\wsmplpxy.dll
• %System Root%\71fd5c133715633609d3\wsmres.dll
• %System Root%\71fd5c133715633609d3\wsmsvc.dll
• %System Root%\71fd5c133715633609d3\wsmwmipl.dll
• %System Root%\71fd5c133715633609d3\powershell.exe
• %System Root%\71fd5c133715633609d3\powershell_ise.exe
• %System Root%\71fd5c133715633609d3\pscustomsetuputil.exe
• %System Root%\71fd5c133715633609d3\pssetupnativeutils.exe
• %System Root%\71fd5c133715633609d3\spuninst.exe
• %System Root%\71fd5c133715633609d3\spupdsvc.exe
• %System Root%\71fd5c133715633609d3\winrs.exe
• %System Root%\71fd5c133715633609d3\winrshost.exe
• %System Root%\71fd5c133715633609d3\wsmanhttpconfig.exe
• %System Root%\71fd5c133715633609d3\wsmprovhost.exe
• %System Root%\71fd5c133715633609d3\wtrinstaller.ico
• %System Root%\71fd5c133715633609d3\winrm.ini
• %System Root%\71fd5c133715633609d3\winrmprov.mof
• %System Root%\71fd5c133715633609d3\wsmauto.mof
• %System Root%\71fd5c133715633609d3\powershell.exe.mui
• %System Root%\71fd5c133715633609d3\profile.ps1
• %System Root%\71fd5c133715633609d3\bitstransfer.format.ps1xml
• %System Root%\71fd5c133715633609d3\certificate.format.ps1xml
• %System Root%\71fd5c133715633609d3\diagnostics.format.ps1xml
• %System Root%\71fd5c133715633609d3\dotnettypes.format.ps1xml
• %System Root%\71fd5c133715633609d3\filesystem.format.ps1xml
• %System Root%\71fd5c133715633609d3\getevent.types.ps1xml
• %System Root%\71fd5c133715633609d3\help.format.ps1xml
• %System Root%\71fd5c133715633609d3\powershellcore.format.ps1xml
• %System Root%\71fd5c133715633609d3\powershelltrace.format.ps1xml
• %System Root%\71fd5c133715633609d3\registry.format.ps1xml
• %System Root%\71fd5c133715633609d3\types.ps1xml
• %System Root%\71fd5c133715633609d3\wsman.format.ps1xml
• %System Root%\71fd5c133715633609d3\bitstransfer.psd1
• %System Root%\71fd5c133715633609d3\importallmodules.psd1
• %System Root%\71fd5c133715633609d3\about_aliases.help.txt
• %System Root%\71fd5c133715633609d3\about_arithmetic_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_arrays.help.txt
• %System Root%\71fd5c133715633609d3\about_assignment_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_automatic_variables.help.txt
• %System Root%\71fd5c133715633609d3\about_bits_cmdlets.help.txt
• %System Root%\71fd5c133715633609d3\about_break.help.txt
• %System Root%\71fd5c133715633609d3\about_command_precedence.help.txt
• %System Root%\71fd5c133715633609d3\about_command_syntax.help.txt
• %System Root%\71fd5c133715633609d3\about_comment_based_help.help.txt
• %System Root%\71fd5c133715633609d3\about_commonparameters.help.txt
• %System Root%\71fd5c133715633609d3\about_comparison_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_continue.help.txt
• %System Root%\71fd5c133715633609d3\about_core_commands.help.txt
• %System Root%\71fd5c133715633609d3\about_data_sections.help.txt
• %System Root%\71fd5c133715633609d3\about_debuggers.help.txt
• %System Root%\71fd5c133715633609d3\about_do.help.txt
• %System Root%\71fd5c133715633609d3\about_environment_variables.help.txt
• %System Root%\71fd5c133715633609d3\about_escape_characters.help.txt
• %System Root%\71fd5c133715633609d3\about_eventlogs.help.txt
• %System Root%\71fd5c133715633609d3\about_execution_policies.help.txt
• %System Root%\71fd5c133715633609d3\about_for.help.txt
• %System Root%\71fd5c133715633609d3\about_foreach.help.txt
• %System Root%\71fd5c133715633609d3\about_format.ps1xml.help.txt
• %System Root%\71fd5c133715633609d3\about_functions.help.txt
• %System Root%\71fd5c133715633609d3\about_functions_advanced.help.txt
• %System Root%\71fd5c133715633609d3\about_functions_advanced_methods.help.txt
• %System Root%\71fd5c133715633609d3\about_functions_advanced_parameters.help.txt
• %System Root%\71fd5c133715633609d3\about_functions_cmdletbindingattribute.help.txt
• %System Root%\71fd5c133715633609d3\about_hash_tables.help.txt
• %System Root%\71fd5c133715633609d3\about_history.help.txt
• %System Root%\71fd5c133715633609d3\about_if.help.txt
• %System Root%\71fd5c133715633609d3\about_job_details.help.txt
• %System Root%\71fd5c133715633609d3\about_jobs.help.txt
• %System Root%\71fd5c133715633609d3\about_join.help.txt
• %System Root%\71fd5c133715633609d3\about_language_keywords.help.txt
• %System Root%\71fd5c133715633609d3\about_line_editing.help.txt
• %System Root%\71fd5c133715633609d3\about_locations.help.txt
• %System Root%\71fd5c133715633609d3\about_logical_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_methods.help.txt
• %System Root%\71fd5c133715633609d3\about_modules.help.txt
• %System Root%\71fd5c133715633609d3\about_objects.help.txt
• %System Root%\71fd5c133715633609d3\about_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_parameters.help.txt
• %System Root%\71fd5c133715633609d3\about_parsing.help.txt
• %System Root%\71fd5c133715633609d3\about_path_syntax.help.txt
• %System Root%\71fd5c133715633609d3\about_pipelines.help.txt
• %System Root%\71fd5c133715633609d3\about_preference_variables.help.txt
• %System Root%\71fd5c133715633609d3\about_profiles.help.txt
• %System Root%\71fd5c133715633609d3\about_prompts.help.txt
• %System Root%\71fd5c133715633609d3\about_properties.help.txt
• %System Root%\71fd5c133715633609d3\about_providers.help.txt
• %System Root%\71fd5c133715633609d3\about_pssession_details.help.txt
• %System Root%\71fd5c133715633609d3\about_pssessions.help.txt
• %System Root%\71fd5c133715633609d3\about_pssnapins.help.txt
• %System Root%\71fd5c133715633609d3\about_quoting_rules.help.txt
• %System Root%\71fd5c133715633609d3\about_redirection.help.txt
• %System Root%\71fd5c133715633609d3\about_ref.help.txt
• %System Root%\71fd5c133715633609d3\about_regular_expressions.help.txt
• %System Root%\71fd5c133715633609d3\about_remote.help.txt
• %System Root%\71fd5c133715633609d3\about_remote_faq.help.txt
• %System Root%\71fd5c133715633609d3\about_remote_jobs.help.txt
• %System Root%\71fd5c133715633609d3\about_remote_output.help.txt
• %System Root%\71fd5c133715633609d3\about_remote_requirements.help.txt
• %System Root%\71fd5c133715633609d3\about_remote_troubleshooting.help.txt
• %System Root%\71fd5c133715633609d3\about_requires.help.txt
• %System Root%\71fd5c133715633609d3\about_reserved_words.help.txt
• %System Root%\71fd5c133715633609d3\about_return.help.txt
• %System Root%\71fd5c133715633609d3\about_scopes.help.txt
• %System Root%\71fd5c133715633609d3\about_script_blocks.help.txt
• %System Root%\71fd5c133715633609d3\about_script_internationalization.help.txt
• %System Root%\71fd5c133715633609d3\about_scripts.help.txt
• %System Root%\71fd5c133715633609d3\about_session_configurations.help.txt
• %System Root%\71fd5c133715633609d3\about_signing.help.txt
• %System Root%\71fd5c133715633609d3\about_special_characters.help.txt
• %System Root%\71fd5c133715633609d3\about_split.help.txt
• %System Root%\71fd5c133715633609d3\about_switch.help.txt
• %System Root%\71fd5c133715633609d3\about_throw.help.txt
• %System Root%\71fd5c133715633609d3\about_transactions.help.txt
• %System Root%\71fd5c133715633609d3\about_trap.help.txt
• %System Root%\71fd5c133715633609d3\about_try_catch_finally.help.txt
• %System Root%\71fd5c133715633609d3\about_type_operators.help.txt
• %System Root%\71fd5c133715633609d3\about_types.ps1xml.help.txt
• %System Root%\71fd5c133715633609d3\about_variables.help.txt
• %System Root%\71fd5c133715633609d3\about_while.help.txt
• %System Root%\71fd5c133715633609d3\about_wildcards.help.txt
• %System Root%\71fd5c133715633609d3\about_windows_powershell_2.0.help.txt
• %System Root%\71fd5c133715633609d3\about_windows_powershell_ise.help.txt
• %System Root%\71fd5c133715633609d3\about_wmi_cmdlets.help.txt
• %System Root%\71fd5c133715633609d3\about_ws-management_cmdlets.help.txt
• %System Root%\71fd5c133715633609d3\default.help.txt
• %System Root%\71fd5c133715633609d3\winrm.vbs
• %System Root%\71fd5c133715633609d3\microsoft.backgroundintelligenttransfer.management.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.diagnostics.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.management.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.powershell.commands.utility.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.powershell.consolehost.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.powershell.security.dll-help.xml
• %System Root%\71fd5c133715633609d3\microsoft.wsman.management.dll-help.xml
• %System Root%\71fd5c133715633609d3\system.management.automation.dll-help.xml
• %System Root%\71fd5c133715633609d3\wsmpty.xsl
• %System Root%\71fd5c133715633609d3\wsmtxt.xsl
• %System Root%\71fd5c133715633609d3\update\kb968930xp.cat
• %System Root%\71fd5c133715633609d3\update\spcustom.dll
• %System Root%\71fd5c133715633609d3\update\updspapi.dll
• %System Root%\71fd5c133715633609d3\update\update.exe
• %System Root%\71fd5c133715633609d3\update\update.inf
• %System Root%\71fd5c133715633609d3\update\eula.txt
• %System Root%\71fd5c133715633609d3\update\update.ver
• %System Root%\71fd5c133715633609d3\$shtdwn$.req

その他

スパイウェアは、以下の不正なWebサイトにアクセスします。

• http://{BLOCKED}7.72.90
• http://{BLOCKED}7.72.90/{random path}
• {BLOCKED}6.18.84
• {BLOCKED}.229.101
• {BLOCKED}.218.105
• {BLOCKED}.252.110
• {BLOCKED}.211.35
• {BLOCKED}246.183
• {BLOCKED}0.71.213
• {BLOCKED}8.163.143
• {BLOCKED}.149.209
• {BLOCKED}.253.109
• {BLOCKED}.242.184
• {BLOCKED}.80.17
• {BLOCKED}11.39
• {BLOCKED}5.159.199
• {BLOCKED}.160.14
• {BLOCKED}3.76.84
• {BLOCKED}0.104.13
• {BLOCKED}9.179.81
• {BLOCKED}9.83.205
• {BLOCKED}.155.128
• {BLOCKED}.175.34
• {BLOCKED}9.125
• {BLOCKED}98.206
• {BLOCKED}.20.22
• {BLOCKED}3.137.168
• {BLOCKED}3.36.220
• {BLOCKED}.193.161
• {BLOCKED}.197.200
• {BLOCKED}79.214
• {BLOCKED}.191.57
• {BLOCKED}.163.31
• {BLOCKED}25.144
• {BLOCKED}.146.235
• {BLOCKED}.109.138
• {BLOCKED}.71.124
• {BLOCKED}31.72
• {BLOCKED}9.102.31
• {BLOCKED}5.247.224
• {BLOCKED}.85.52
• {BLOCKED}3.110
• {BLOCKED}0.179.176
• {BLOCKED}2.113.91
• {BLOCKED}4.187.220
• {BLOCKED}6.92.109
• {BLOCKED}.65.12
• {BLOCKED}4.19.68
• {BLOCKED}57.208
• {BLOCKED}.232.174
• {BLOCKED}.157.135
• {BLOCKED}6.86.136
• {BLOCKED}9.185.169
• {BLOCKED}.26.187
• {BLOCKED}.15.21
• {BLOCKED}3.106.12
• {BLOCKED}5.108.158
• {BLOCKED}0.168.42
• {BLOCKED}.196.94
• {BLOCKED}8.237.208
• {BLOCKED}5.131.246
• {BLOCKED}.195.165
• {BLOCKED}1.72.80
• {BLOCKED}.144.251
• {BLOCKED}8.233.109
• {BLOCKED}2.21.219
• {BLOCKED}.199.197
• {BLOCKED}4.135.227
• {BLOCKED}8.215.74
• {BLOCKED}197.21
• {BLOCKED}.234.201
• {BLOCKED}.58.75
• {BLOCKED}3.184.188
• {BLOCKED}.144.58
• {BLOCKED}0.127.203
• {BLOCKED}.83.65
• {BLOCKED}136.26
• {BLOCKED}.122.199
• {BLOCKED}.203.35
• {BLOCKED}.19.182
• {BLOCKED}7.154.218
• {BLOCKED}.38.106
• {BLOCKED}8.70.137
• {BLOCKED}8.4.6
• {BLOCKED}3.157.226
• {BLOCKED}.8.214
• {BLOCKED}3.31.222
• {BLOCKED}.19.165
• {BLOCKED}3.149.4
• {BLOCKED}9.246.147
• {BLOCKED}103.176
• {BLOCKED}.86.91
• {BLOCKED}96.108
• {BLOCKED}9.33.53
• {BLOCKED}5.201.179
• {BLOCKED}146.99
• {BLOCKED}62.35
• {BLOCKED}7.82.243
• {BLOCKED}1.105.21
• {BLOCKED}.49.153
• {BLOCKED}39.98
• {BLOCKED}7.135.186
• {BLOCKED}.213.135
• {BLOCKED}8.130.204
• {BLOCKED}.52.190
• {BLOCKED}213.225
• {BLOCKED}.212.172
• {BLOCKED}4.40.183
• {BLOCKED}.77.179
• {BLOCKED}4.161.149
• {BLOCKED}5.146.160
• {BLOCKED}7.75.219
• {BLOCKED}4.151.160
• {BLOCKED}.70.251
• {BLOCKED}.34.158
• {BLOCKED}62.80
• {BLOCKED}8.166.106
• {BLOCKED}.50.150
• {BLOCKED}.30.238
• {BLOCKED}.216.63
• {BLOCKED}.43.119
• {BLOCKED}8.30.254
• {BLOCKED}5.37.178
• {BLOCKED}.113.9
• {BLOCKED}1.123.80
• {BLOCKED}.59.237
• {BLOCKED}3.229.66
• {BLOCKED}.75.224
• {BLOCKED}3.246.85
• {BLOCKED}3.124.103
• {BLOCKED}4.120.187
• {BLOCKED}.195.207
• {BLOCKED}6.25.13
• {BLOCKED}4.78.49
• {BLOCKED}3.155.104
• {BLOCKED}104.229
• {BLOCKED}50.68
• {BLOCKED}4.54.149
• {BLOCKED}7.171.1
• {BLOCKED}95.144
• {BLOCKED}.102.178
• {BLOCKED}8.216.141
• {BLOCKED}.180.164
• {BLOCKED}2.9.158
• {BLOCKED}.203.131
• {BLOCKED}248.18
• {BLOCKED}2.197.199
• {BLOCKED}2.22.59
• {BLOCKED}119.65
• {BLOCKED}6.210.134
• {BLOCKED}.114.181
• {BLOCKED}138.144
• {BLOCKED}9.158.151
• {BLOCKED}1.219.221
• {BLOCKED}.141.116
• {BLOCKED}160.220
• {BLOCKED}205.111
• {BLOCKED}.83.39
• {BLOCKED}42.74
• {BLOCKED}248.125
• {BLOCKED}.56.2
• {BLOCKED}54.80
• {BLOCKED}.24.230
• {BLOCKED}237.212
• {BLOCKED}.55.207
• {BLOCKED}.164.4
• {BLOCKED}.56.71
• {BLOCKED}1.232.164
• {BLOCKED}.154.119
• {BLOCKED}79.157
• {BLOCKED}.20.231
• {BLOCKED}.133.209
• {BLOCKED}11.18
• {BLOCKED}.52.55
• {BLOCKED}5.105.255
• {BLOCKED}0.97.217
• {BLOCKED}1.214.103
• {BLOCKED}1.146.120
• {BLOCKED}.14.21
• {BLOCKED}9.254.118
• {BLOCKED}226.53
• {BLOCKED}82.77
• {BLOCKED}6.16.113
• {BLOCKED}2.253.218
• {BLOCKED}2.153.196
• {BLOCKED}.209.84
• {BLOCKED}.12.77
• {BLOCKED}.239.247
• {BLOCKED}5.126.204
• {BLOCKED}.239.203
• {BLOCKED}.94.4
• {BLOCKED}0.22.47
• {BLOCKED}.153.244
• {BLOCKED}.162.4
• {BLOCKED}7.224
• {BLOCKED}0.211.239
• {BLOCKED}0.93.241
• {BLOCKED}1.34.10
• {BLOCKED}.225.139
• {BLOCKED}.13.135
• {BLOCKED}138.108
• {BLOCKED}7.212.158
• {BLOCKED}1.191.218
• {BLOCKED}.196.193
• {BLOCKED}.141.247
• {BLOCKED}1.121.54
• {BLOCKED}0.110.151
• {BLOCKED}8.155.154
• {BLOCKED}111.165
• {BLOCKED}7.159.150
• {BLOCKED}.136.123
• {BLOCKED}50.202
• {BLOCKED}.198.210
• {BLOCKED}7.185.181
• {BLOCKED}.90.89
• {BLOCKED}.178.50
• {BLOCKED}17.194
• {BLOCKED}0.60.81
• {BLOCKED}.71.23
• {BLOCKED}2.146
• {BLOCKED}87.124
• {BLOCKED}1.168.234
• {BLOCKED}.169.184
• {BLOCKED}7.62.50
• {BLOCKED}61.230
• {BLOCKED}59.92
• {BLOCKED}168.203
• {BLOCKED}.44.164
• {BLOCKED}116.163
• {BLOCKED}.159.182
• {BLOCKED}.252.141
• {BLOCKED}209.122
• {BLOCKED}8.234.186
• {BLOCKED}123.52
• {BLOCKED}3.247.180
• {BLOCKED}5.225.115
• {BLOCKED}40.197

スパイウェアは、実行後、自身を削除します。

このウイルス情報は、自動解析システムにより作成されました。