![Trend Micro Security](https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png)
Ransom.Win32.SODINOKIBI.ASDKI
Trojan.Win32.DelShad.abl (Kaspersky); Trojan-Ransom.Sodinokibi (Ikarus)
Windows
![](/vinfo/imgFiles/JPlegend.jpg)
- マルウェアタイプ: 身代金要求型不正プログラム(ランサムウェア)
- 破壊活動の有無: なし
- 暗号化:
- 感染報告の有無: はい
概要
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
詳細
侵入方法
マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。
インストール
マルウェアは、以下のプロセスを追加します。
- vssadmin.exe Delete Shadows /All /Quiet → deletes shadow copies
- bcdedit /set {default} recoveryenabled No → disables startup repair
- bcdedit /set {default} bootstatuspolicy ignoreallfailures → disables windows error recovery
他のシステム変更
マルウェアは、以下のレジストリキーを追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
マルウェアは、以下のレジストリ値を追加します。
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
pvg = {Hex Bytes}
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
sxsP = {Hex Bytes}
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
BDDC8 = {Hex Bytes}
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
f7gVD7 = {Hex Bytes}
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
Xu7Nnkd = {Appended File Extension]
HKEY_LOCAL_MACHINE\SOFTWARE\QtProject\
OrganizationDefaults
sMMnxpgk = {Hex Bytes}
マルウェアは、以下のレジストリ値を変更し、デスクトップの壁紙を変更します。
HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{random}.bmp
マルウェアは、コンピュータのデスクトップの壁紙に以下の画像を設定します。
作成活動
マルウェアは、以下のファイルを作成します。
- %User Temp%\{random characters}.bmp → ransom wallpaper
- {encrypted folder}\{appended ransom extension}-readme.txt → ransom note
(註:%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\<ユーザー名>\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\<ユーザ名>\AppData\Local\Temp" です。)
情報漏えい
マルウェアは、以下の情報を収集します。
- Computer name
- User name
- Workgroup
- Processor
- Operating System
- System Architecture
情報収集
マルウェアは、HTTPポスト を介して、収集した情報を以下のURLに送信します。
- https://{domain}/{string 1}/{string 2}/{random characters}.{string 3}
- {domain}:
- {BLOCKED}oncrete.com
- {BLOCKED}qca.com
- {BLOCKED}lay.ca
- {BLOCKED}hiro.com
- {BLOCKED}irossana.it
- {BLOCKED}x.co.uk
- {BLOCKED}bblephotography.com
- {BLOCKED}at-pismo-gubernatoru.ru:443
- {BLOCKED}ifi.com
- {BLOCKED}t.sk
- {BLOCKED}k.com
- {BLOCKED}ropi.com.br
- {BLOCKED}acks.com
- {BLOCKED}eymourphotography.co.uk
- {BLOCKED}nllp.com
- {BLOCKED}r.nl
- {BLOCKED}vantonline.eu
- {BLOCKED}istdistinctives.org
- {BLOCKED}eb.net
- {BLOCKED}omattalar.com
- {BLOCKED}a.nl
- {BLOCKED}ksrock.com
- {BLOCKED}g-zelem.de
- {BLOCKED}rcosmicbeing.com
- {BLOCKED}aniuklaw.com
- {BLOCKED}rd-totaal.nl
- {BLOCKED}ttekniksipil.com
- {BLOCKED}densee-buhne11.de
- {BLOCKED}tagsrassismus-entknoten.de
- {BLOCKED}atri.be
- {BLOCKED}c.ca
- {BLOCKED}vapourbarrier.com
- {BLOCKED}arspor.org.tr
- {BLOCKED}thelook.com
- {BLOCKED}ertube.net
- {BLOCKED}konie-weitramsdorf-sesslach.de
- {BLOCKED}gefxinc.com
- {BLOCKED}nessblenderstory.com
- {BLOCKED}nededenroth.dk
- {BLOCKED}leystreetspineclinic.com
- {BLOCKED}og.fr
- {BLOCKED}-cupboard.co.uk
- {BLOCKED}bipdeco.site
- {BLOCKED}nkgoll.com
- {BLOCKED}etuniversiteit.nl
- {BLOCKED}rtspeak.com
- {BLOCKED}plus.be
- {BLOCKED}ing.academy
- {BLOCKED}toniatonaggelon.gr
- {BLOCKED}helor.com
- {BLOCKED}dolandscapes.com
- {BLOCKED}shnabrawijaya.com
- {BLOCKED}umsittard.nl
- {BLOCKED}aartgallery.jp
- {BLOCKED}rella.com
- {BLOCKED}avlete.com
- {BLOCKED}baramcfadyenjewelry.com
- {BLOCKED}arnille.se
- {BLOCKED}p.org
- {BLOCKED}ellrardon.com
- {BLOCKED}inum.pt
- {BLOCKED}amidwifery.com
- {BLOCKED}epreprod4.com
- {BLOCKED}ermattswisswatches.ch
- {BLOCKED}ynthacademy.org
- {BLOCKED}tiocafeblog.wordpress.com
- {BLOCKED}anpublishing.co.uk
- {BLOCKED}x.is
- {BLOCKED}con.com
- {BLOCKED}uiblog.com
- {BLOCKED}skaremote.com
- {BLOCKED}vita.de
- {BLOCKED}ye.com
- {BLOCKED}semetgesigte.co.za
- {BLOCKED}idhosting.nl
- {BLOCKED}pitalitytrainingsolutions.co.uk
- {BLOCKED}agazine.ru
- {BLOCKED}indentistry.com
- {BLOCKED}po.org
- {BLOCKED}-jjb.fr
- {BLOCKED}duga.info
- {BLOCKED}efietsenblog.nl
- {BLOCKED}esources.com
- {BLOCKED}s-kuck.de
- {BLOCKED}ediainc.com
- {BLOCKED}noimmobilier.com
- {BLOCKED}linburgcottage.com
- {BLOCKED}namedia.de
- {BLOCKED}pleitsolutions.ch
- {BLOCKED}chsale.biz
- {BLOCKED}nisverschuur.com
- {BLOCKED}adloftladders.co.uk
- {BLOCKED}talcircle.com
- {BLOCKED}laprome.eu
- {BLOCKED}nstonmingmanning.com
- {BLOCKED}thmoulis.gr
- {BLOCKED}doctordallas.com
- {BLOCKED}uwsindeklas.be
- {BLOCKED}-immo-agentur.de
- {BLOCKED}jektparkiet.pl
- {BLOCKED}puter-place.de
- {BLOCKED}a.co.uk
- {BLOCKED}dakids.com
- {BLOCKED}bianmice.com
- {BLOCKED}-billigafrgpatroner-stb.se
- {BLOCKED}kittickets.com
- {BLOCKED}ewmedia.de
- {BLOCKED}lp.co.uk
- {BLOCKED}hardmaybury.co.uk
- {BLOCKED}tonag.com
- {BLOCKED}anscan.org
- {BLOCKED}r-biznes.com
- {BLOCKED}no-turf.com
- {BLOCKED}akaudible.com
- {BLOCKED}mccallum.com
- {BLOCKED}e.matthies.de
- {BLOCKED}therjees.com
- {BLOCKED}opingcrane.com
- {BLOCKED}soflove.org:443
- {BLOCKED}tastay.com
- {BLOCKED}eitapernambuco.com
- carsten.{BLOCKED}-it.de
- {BLOCKED}lfiegel.com
- {BLOCKED}k.zp.ua
- {BLOCKED}aneosteopathic.com.au
- {BLOCKED}rete.com
- {BLOCKED}sonalessandro.com
- {BLOCKED}oyscustom.com
- {BLOCKED}itting-hk.helpergo.co
- {BLOCKED}well.com.sg
- {BLOCKED}rk.nl
- {BLOCKED}attmediations.com
- {BLOCKED}lowersandrakes.com
- {BLOCKED}edia.com
- {BLOCKED}yseurdetransformation.com
- {BLOCKED}vanvulpen.nl
- {BLOCKED}oxtel.uk
- {BLOCKED}loripa.be
- {BLOCKED}eranch.com
- {BLOCKED}rywizuk.com
- {BLOCKED}malmahdi.com
- {BLOCKED}ellezaysalud.com
- {BLOCKED}anprimaunggul.org
- {BLOCKED}nechic.com
- {BLOCKED}nes.com
- {BLOCKED}surrection.com
- {BLOCKED}arm.dk
- {BLOCKED}c-beethovenstrasse-ag.ch
- {BLOCKED}amarketingdigital.com.br
- {BLOCKED}letdelsindians.es
- {BLOCKED}siniacademy.org
- {BLOCKED}enforensic.com
- {BLOCKED}-okna23.ru
- {BLOCKED}tinezilustrador.com
- {BLOCKED}nt-voice.com
- {BLOCKED}nbryan.com
- {BLOCKED}tianscholz.de
- {BLOCKED}echnologies.net
- {BLOCKED}agefinancial.com
- {BLOCKED}n-prijs.nl
- {BLOCKED}henghotel.com
- {BLOCKED}tivadigital.com
- {BLOCKED}literviertel.com
- {BLOCKED}center-butzbach-werbemittel.de
- {BLOCKED}iaecoturismo.com.br
- {BLOCKED}-storage.co.uk
- {BLOCKED}arinefoundation.com
- {BLOCKED}compserver.de
- {BLOCKED}2biz.com
- {BLOCKED}ukaruva.com
- {BLOCKED}ngbangladesh.net
- {BLOCKED}rnitureco.com
- {BLOCKED}ldeep.com
- {BLOCKED}liedjeszingen.nl
- {BLOCKED}spics.co.uk
- {BLOCKED}tvisual.com
- {BLOCKED}0addfr4ahr.dp.ua
- {BLOCKED}ambv.nl
- {BLOCKED}kapod.com
- {BLOCKED}abrown.com
- {BLOCKED}masters.com
- {BLOCKED}officespaces.net
- bg.{BLOCKED}in.pl
- {BLOCKED}w.com
- {BLOCKED}phold-sjaelland.dk
- {BLOCKED}lai.com
- {BLOCKED}shopping.com
- {BLOCKED}ikstudio-visuell.de
- {BLOCKED}ase.pl
- {BLOCKED}nishstudio.co.uk
- {BLOCKED}monti.com
- {BLOCKED}ingceremonieswithtim.com
- {BLOCKED}hoekzema.nl
- {BLOCKED}ine-des-pothiers.com
- {BLOCKED}ip.com
- {BLOCKED}ncretecoatings.com
- {BLOCKED}i-dress.com
- {BLOCKED}-week-diet.net
- {BLOCKED}edevries.com
- {BLOCKED}larquotes.com
- {BLOCKED}om.com
- {BLOCKED}engatton.com
- {BLOCKED}ets-clubs.co.uk
- {BLOCKED}easkildegaard.dk
- {BLOCKED}oucan.com
- {BLOCKED}ssreliefadvice.com
- {BLOCKED}alcompliancenews.com
- {BLOCKED}nixcrane.com
- {BLOCKED}s.de
- {BLOCKED}bki.ru
- {BLOCKED}eport.com
- {BLOCKED}computer-support-hamburg.de
- {BLOCKED}el-york.com
- {BLOCKED}ademmobil.com.tr
- {BLOCKED}bo.it
- {BLOCKED}mmunity.de
- {BLOCKED}luno.com
- {BLOCKED}hetalk.com
- {BLOCKED}lochversicherung.info
- {BLOCKED}crosshideout.com
- {BLOCKED}lerysalonsoho.com:443
- {BLOCKED}ness-basic.de
- {BLOCKED}oradio.de
- {BLOCKED}adodelrio.com
- {BLOCKED}esscolony.com.ng
- {BLOCKED}spinner.com
- {BLOCKED}sschool.ru
- {BLOCKED}hindsight.info
- {BLOCKED}i.store
- {BLOCKED}ajosediazdemera.com
- {BLOCKED}nonecampaign.com
- {BLOCKED}ianhweeks.com
- {BLOCKED}dultere.fr
- {BLOCKED}onalbrightdds.com
- {BLOCKED}esofwa.com
- {BLOCKED}andgo.hu
- {BLOCKED}ans.com
- {BLOCKED}age.fr
- {BLOCKED}asfiloxenia.gr
- {BLOCKED}ch-made.com
- {BLOCKED}daddyblog.com
- {BLOCKED}ndschiess.de
- {BLOCKED}ansconsult.com
- {BLOCKED}ntidigitali.com
- {BLOCKED}monturkiye.com
- {BLOCKED}tenreich-brilon.de
- {BLOCKED}ionsigns.com
- {BLOCKED}iss.ru
- {BLOCKED}tgood.com
- {BLOCKED}-teleachat.fr
- {BLOCKED}lettabordeaux.fr
- {BLOCKED}temakersheerenveen.nl
- {BLOCKED}usce.com
- {BLOCKED}ierkomon.com
- {BLOCKED}upblanc.gr
- {BLOCKED}oardjournal.com
- {BLOCKED}ingwheel.com
- {BLOCKED}tysspices.com
- {BLOCKED}ahome.co.uk
- {BLOCKED}ienbepthanhdat.com
- {BLOCKED}rsunindo.com
- {BLOCKED}essurecleaning.com
- {BLOCKED}-mediation.org
- {BLOCKED}stats.com
- {BLOCKED}oexin10.com
- {BLOCKED}hinadaydentalimplants.com
- {BLOCKED}ak.com
- {BLOCKED}developer.com
- {BLOCKED}onsultancy.com
- {BLOCKED}lecitydj.com
- {BLOCKED}dsrejserallinclusive.dk
- {BLOCKED}yman-silkeborg.dk
- {BLOCKED}enhaus-erfurt.de
- {BLOCKED}tron.com
- {BLOCKED}strom.com
- {BLOCKED}cine.de
- {BLOCKED}andseen.com
- {BLOCKED}financialservices.com
- {BLOCKED}rezprono.com
- {BLOCKED}mme.com
- {BLOCKED}e.co
- {BLOCKED}beauty-guides.com
- {BLOCKED}i.pe
- {BLOCKED}eleyezstripclub.com
- {BLOCKED}anviruses.org
- {BLOCKED}plettagaite.fr
- {BLOCKED}hovecounsellingpractice.co.uk
- {BLOCKED}dentalblue.com
- {BLOCKED}bilisateur.fr
- {BLOCKED}t.ag
- {BLOCKED}als.com
- {BLOCKED}intpt.com
- {BLOCKED}aribeaute-nani.com
- {BLOCKED}identity.com
- {BLOCKED}stomoveamerica.org
- {BLOCKED}vijesti.net
- {BLOCKED}gamarbella.com
- {BLOCKED}is-anne.com
- {BLOCKED}experts.de
- {BLOCKED}oboss163.ru:443
- {BLOCKED}tanwarehouse.co.uk
- {BLOCKED}iotherapierijnmond.nl
- {BLOCKED}tsportsequip.com
- {BLOCKED}terce.com
- {BLOCKED}haagfoodie.nl
- {BLOCKED}lavalentine.com
- {BLOCKED}chup-mag.com
- {BLOCKED}-gamer.pl
- {BLOCKED}rtmind.net
- {BLOCKED}ra-collectivites.com
- {BLOCKED}dsandloyalty.com
- {BLOCKED}ius.dk
- {BLOCKED}studio.academy
- {BLOCKED}o.net.au
- {BLOCKED}poracionrr.com
- {BLOCKED}denavigator.ch
- {BLOCKED}iano.fr
- {BLOCKED}utionshosting.co.uk
- {BLOCKED}eneyetattoo.com
- {BLOCKED}anroomequipment.ie
- {BLOCKED}dardleadership.org
- {BLOCKED}pergreenfarmcatering.com.au
- {BLOCKED}vidmag.com
- {BLOCKED}riotcleaning.net
- {BLOCKED}eshistoria.com
- {BLOCKED}somattonecase.it
- {BLOCKED}olibrerie.it
- {BLOCKED}uli.com.au
- {BLOCKED}iemaccreative.wordpress.com
- {BLOCKED}uktia.fi
- {BLOCKED}efoods.ro
- {BLOCKED}owieszczecin.pl
- {BLOCKED}turo.academy
- {BLOCKED}b.ch
- {BLOCKED}carefoundation.org
- {BLOCKED}a.se
- {BLOCKED}b865.com
- {BLOCKED}bscore.com
- {BLOCKED}g.me
- {BLOCKED}mtron.fr
- {BLOCKED}armeko-group.com
- {BLOCKED}ller.nl
- {BLOCKED}aftingalegacy.com
- {BLOCKED}zoekgod.be
- {BLOCKED}cquesgarcianoto.com
- {BLOCKED}inowarehousespace.com
- {BLOCKED}imemarineengineering.com
- {BLOCKED}shigangoly.com
- {BLOCKED}sa-poncon.fr
- {BLOCKED}ssocrm.com
- {BLOCKED}byard.com
- {BLOCKED}hikuchen.com
- {BLOCKED}imalfood-online.de
- {BLOCKED}acebel.be
- {BLOCKED}llegetennis.info
- {BLOCKED}nd2muscle.nl
- {BLOCKED}pcarrental.ae
- {BLOCKED}toeditores.com
- {BLOCKED}mac.com
- {BLOCKED}eoflightmusic.com
- {BLOCKED}ownswoodblog.com
- {BLOCKED}itesartemis.gr
- {BLOCKED}tesacademy.it
- {BLOCKED}tallbau-hartmann.eu
- {BLOCKED}-danmark.dk
- {BLOCKED}censoredhentaigif.com
- {BLOCKED}sane.agency
- {BLOCKED}uelakevision.com
- {BLOCKED}imation-pro.co.uk
- {BLOCKED}adforensics.com
- {BLOCKED}nelsonpediatrics.com
- {BLOCKED}bforsale.com
- {BLOCKED}ttalvor.com
- avis.{BLOCKED}a.it
- {BLOCKED}even.be
- {BLOCKED}etmcshane.com
- {BLOCKED}tactodirecto.com
- {BLOCKED}sregisteret.no
- {BLOCKED}luchesi.it
- {BLOCKED}onbooks.com
- {BLOCKED}i.ch
- {BLOCKED}t-m.ru
- {BLOCKED}tion-stills.co.uk
- {BLOCKED}nski.eu
- {BLOCKED}i.com
- {BLOCKED}bs.com
- {BLOCKED}tion-medical.online
- {BLOCKED}ools.ng
- {BLOCKED}okus.com
- {BLOCKED}s72.com
- {BLOCKED}ash.com
- {BLOCKED}s.info
- {BLOCKED}eakers.com
- {BLOCKED}team.com
- {BLOCKED}teplo.com
- {BLOCKED}erverein-vatterschule.de
- {BLOCKED}nimage.ae
- {BLOCKED}nergyinternational.com
- {BLOCKED}turbo.de
- {BLOCKED}ight.com
- {BLOCKED}root.co
- {BLOCKED}paneselesbian.com
- {BLOCKED}derland.nl
- {BLOCKED}pany.com
- {BLOCKED}cophilippines.com
- {BLOCKED}iopolitica.com
- {BLOCKED}u.fr
- {BLOCKED}etruck.de
- {BLOCKED}ored-shelves.com
- {BLOCKED}derbox.ch
- {BLOCKED}tha-frets-ceramics.nl
- {BLOCKED}howo.pl
- {BLOCKED}gletonfinancial.com
- {BLOCKED}icalduniya.com
- {BLOCKED}sioninthedesert.com
- {BLOCKED}autoinsurers.net
- {BLOCKED}n.ro
- {BLOCKED}o.ae
- {BLOCKED}aitspain.com
- {BLOCKED}artuplive.org
- {BLOCKED}ems-for-the-soul.ch
- {BLOCKED}edesign.com
- {BLOCKED}tturestaurante.com.br
- {BLOCKED}eamvoiceclub.org
- {BLOCKED}hop.design
- {BLOCKED}wthornsretirement.co.uk
- {BLOCKED}odentify.ai
- {BLOCKED}rkzeugtrolley.net
- {BLOCKED}ascd.com
- {BLOCKED}urnextshoes.com
- {BLOCKED}gvalue.com
- {BLOCKED}mollerpension.com
- {BLOCKED}ohous.com
- {BLOCKED}brh.com
- {BLOCKED}rickennedymacfoy.com
- {BLOCKED}eetz.fr
- {BLOCKED}etymichalovce.sk
- {BLOCKED}fx.pro
- {BLOCKED}tomealprep.academy
- {BLOCKED}sofare.co
- {BLOCKED}tteoruzzaofficial.com
- {BLOCKED}dishallgood.com
- {BLOCKED}chainchiuk.com
- {BLOCKED}xcube24.com.ua
- {BLOCKED}nsolutions.es
- {BLOCKED}lsigordon.com
- {BLOCKED}rdpress.idium.no
- {BLOCKED}ogeeconseils.fr
- {BLOCKED}scenter.com
- {BLOCKED}chal-s.co.il
- {BLOCKED}erich-umzug.ch
- {BLOCKED}ovefullcircle.com
- {BLOCKED}ninggibadan.co.id
- {BLOCKED}llyoart.com
- {BLOCKED}nitabeachassociation.com
- {BLOCKED}ryairbnb.wordpress.com
- {BLOCKED}rentsandkids.com
- {BLOCKED}binsurance.com
- {BLOCKED}yprogulka.ru
- {BLOCKED}c-eu.com
- {BLOCKED}lterman.es
- {BLOCKED}ible.co
- {BLOCKED}c24.com
- {BLOCKED}azi.eus
- {BLOCKED}damarfil.com
- {BLOCKED}ctoriareloj.com
- {BLOCKED}camoregreenapts.com
- {BLOCKED}uvelland-oaze.nl
- {BLOCKED}novationgames-brabant.nl
- {BLOCKED}ulanov.com
- {BLOCKED}r-stempelking.de
- {BLOCKED}stevirginia.com
- {BLOCKED}ofessionetata.com
- {BLOCKED}kecrm.com
- {BLOCKED}vomask.com
- {BLOCKED}rksideseniorliving.net
- {BLOCKED}lyginnikitav.000webhostapp.com
- {BLOCKED}det150ans.com
- {BLOCKED}lovecustomers.fr
- {BLOCKED}ikcoach.com
- {BLOCKED}diogiro.com.ar
- {BLOCKED}ristopherhannan.com
- {BLOCKED}tableacrepes-meaux.fr
- {BLOCKED}vbec.com
- {BLOCKED}re-space.com
- {BLOCKED}ighthillgroup.com
- {BLOCKED}moserescritor.com
- {BLOCKED}percarhire.co.uk
- {BLOCKED}x-interim-and-projectmanagement.com
- {BLOCKED}sinodepositors.com
- {BLOCKED}vancedeyecare.com
- {BLOCKED}triplica.academy
- {BLOCKED}otenmakerszwijndrecht.nl
- {BLOCKED}o-academy.com
- {BLOCKED}name.kz
- {BLOCKED}entedlair.com
- {BLOCKED}udionumerik.fr
- {BLOCKED}khjalmar.se
- {BLOCKED}epertgrafikweb.at
- {BLOCKED}stangmarketinggroup.com
- {BLOCKED}atek-immobilien.de
- {BLOCKED}rtsdiscountguns.com
- {BLOCKED}icjapanart.com
- {BLOCKED}rraflair.de
- {BLOCKED}ar.com
- {BLOCKED}sydental.ae
- {BLOCKED}ewsstar.com
- {BLOCKED}ysio-lang.de
- {BLOCKED}milivefurniture.com
- {BLOCKED}sisatonarim.com
- {BLOCKED}otographycreativity.co.uk
- {BLOCKED}onenjoen.fi
- {BLOCKED}erenambulancealkmaar.nl
- {BLOCKED}byaudiology.com
- {BLOCKED}ntingwell.com
- {BLOCKED}udaespiritualtamara.com
- {BLOCKED}lcpa.com
- {BLOCKED}chardkershawwines.co.za
- {BLOCKED}nukumbak.com
- {BLOCKED}thebackofthemoon.com
- {BLOCKED}troton.ru
- {BLOCKED}k-tp1.de
- {BLOCKED}bkiwi.com.ng
- {BLOCKED}urhappyevents.fr
- {BLOCKED}naldhendriks.nl
- {BLOCKED}ndel-partner.de
- {BLOCKED}ag-blog.de
- {BLOCKED}dkopingsnytt.nu
- {BLOCKED}lonlamar.nl
- {BLOCKED}graph.fr
- {BLOCKED}rthplacemag.com
- {BLOCKED}graphisme.fr
- {BLOCKED}llymccarthydesign.com
- {BLOCKED}te.markkit.com.br
- {BLOCKED}cadagofis.com
- {BLOCKED}srl.it
- {BLOCKED}ur-ways.com
- {BLOCKED}-elka.ru
- {BLOCKED}llity.hu
- {BLOCKED}occolisoep.nl
- {BLOCKED}lleepollee.com
- {BLOCKED}dwestschool.org
- {BLOCKED}tormmcosta.com
- {BLOCKED}enceassemble.fr
- {BLOCKED}actusnhlstenden.com
- {BLOCKED}v-f.de
- {BLOCKED}2fly.com
- {BLOCKED}tionnewsroom.com
- {BLOCKED}sprop.com
- {BLOCKED}etbalhoogeveen.nl
- {BLOCKED}rbouwingsdouche.nl
- {BLOCKED}yshoreelite.com
- {BLOCKED}riannelemenestrel.com
- {BLOCKED}aftstone.co.nz
- {BLOCKED}isodentalcare.com
- {BLOCKED}int-malo-developpement.fr
- {BLOCKED}linetvgroup.com
- {BLOCKED}orgemuncey.com
- {BLOCKED}legationhub.com
- {BLOCKED}itkeramika-shop.com.ua
- {BLOCKED}ringfieldplumbermo.com
- {BLOCKED}demurray.com
- {BLOCKED}mbaglow.com
- {BLOCKED}trographic.com
- {BLOCKED}idalcave.com
- {BLOCKED}tcalfe.ca
- {BLOCKED}terlinkone.com
- {BLOCKED}rinkingplanet.com
- {BLOCKED}plora.nl
- {BLOCKED}sondriversforwindows.com
- {BLOCKED}n.nu
- {BLOCKED}izenmetkinderen.be
- {BLOCKED}tchstyle.co.uk
- {BLOCKED}audiakilian.de
- {BLOCKED}riturismocastagneto.it
- {BLOCKED}reelements.nl
- {BLOCKED}sajjongeren.nl
- {BLOCKED}lade.nl
- {BLOCKED}erbaycanas.com
- {BLOCKED}lotgreen.com
- {BLOCKED}playwin3.com
- {BLOCKED}nenymus.com
- {BLOCKED}eneulberg.de
- {BLOCKED}ukaip.ru
- {BLOCKED}ticahubertruiz.com
- {BLOCKED}hroederschoembs.com
- {BLOCKED}shandbrowenvy.com
- {BLOCKED}emiumweb.com.ua:443
- {BLOCKED}zift.dk
- {BLOCKED}hactors.com
- {BLOCKED}ardcentraal.nl
- {BLOCKED}veyourheartout.co
- {BLOCKED}annbornfastigheter.se
- {BLOCKED}lligeflybilletter.dk
- {BLOCKED}ectricianul.com
- {BLOCKED}iarista.de
- {BLOCKED}ndgoedspica.nl
- {BLOCKED}inx.com
- {BLOCKED}llthewrightway.com
- {BLOCKED}setsanitas.dk
- {BLOCKED}novationgames-brabant.nl
- {BLOCKED}0.dk
- {BLOCKED}thakapitalforvaltning.dk
- {BLOCKED}nkxgayvideoawards.com
- {BLOCKED}latee-couture.com
- {BLOCKED}tering.com
- {BLOCKED}elielecompte.wordpress.com
- {BLOCKED}tocontatto.net
- {BLOCKED}chardiv.com
- {BLOCKED}oweb.software
- {BLOCKED}erapybusinessacademy.com
- {BLOCKED}ok.academy
- {BLOCKED}traz.pl
- {BLOCKED}loria.de
- {BLOCKED}auty-traveller.com
- {BLOCKED}uticmarine.dk
- {BLOCKED}ralsund-ansichten.de
- {BLOCKED}obal-migrate.com
- {BLOCKED}tassociation.com
- {BLOCKED}lldeeke.de
- {BLOCKED}iagoperez.com
- {BLOCKED}nstarrsoccer.com
- {BLOCKED}n.nl
- {BLOCKED}rca.net
- {BLOCKED}ohedd.com
- {BLOCKED}obalskills.pt
- {BLOCKED}tzen-reinigen.com
- {BLOCKED}rserviceunlimited.com
- {BLOCKED}otlandsroute66.co.uk
- {BLOCKED}bcleaner.fr
- {BLOCKED}yboundnutrition.co.uk
- {BLOCKED}idpiping.de
- {BLOCKED}hetrabalhos.com
- {BLOCKED}i-france.fr
- {BLOCKED}verpoolabudhabi.ae
- {BLOCKED}rgroup.it
- {BLOCKED}carrot.com
- {BLOCKED}nedrinkdetroit.com
- {BLOCKED}ortowebdesign.com
- {BLOCKED}lielusktherapy.com
- {BLOCKED}notruckwreckers.com.au
- {BLOCKED}tton-avenue.co.il
- {BLOCKED}eatre-embellie.fr
- {BLOCKED}waiisteelbuilding.com
- {BLOCKED}verfiestas.com.es
- {BLOCKED}mpinglaforetdetesse.com
- {BLOCKED}aitware.com
- {BLOCKED}uzfluzrewards.com
- {BLOCKED}lynine.com
- {BLOCKED}okooo.com
- {BLOCKED}opoldineroux.com
- {BLOCKED}thler.nl
- {BLOCKED}ofibersan.com
- {BLOCKED}nsleymarketing.com
- {BLOCKED}e5thquestion.com
- {BLOCKED}hlagbohrmaschinetests.com
- {BLOCKED}vinsburger.fr
- {BLOCKED}abamaroofingllc.com
- {BLOCKED}ende-pflanzenparadies.de
- {BLOCKED}mphishealthandwellness.com
- {BLOCKED}trx.com
- {BLOCKED}relinjames.com
- {BLOCKED}ride.live
- {BLOCKED}mrutkuyutemel.com
- {BLOCKED}rfectgrin.com
- {BLOCKED}ita.ac
- {BLOCKED}nksrl.co.za
- {BLOCKED}hluesseldienste-hannover.de
- {BLOCKED}xx-repair.com
- {BLOCKED}linemarketingsurgery.co.uk
- {BLOCKED}liak.com
- {BLOCKED}toblog.org
- {BLOCKED}ennverschueren.be
- {BLOCKED}ock-optic.com
- {BLOCKED}mounie.com
- {BLOCKED}ggestar.ch
- {BLOCKED}aginekithomes.co.nz
- {BLOCKED}meswilliamspainting.com
- {BLOCKED}ringnosis.academy
- {BLOCKED}eedekansenloket.nl
- {BLOCKED}zmata.com
- {BLOCKED}olaiamedispa.com
- {BLOCKED}ranjtuition.org
- {BLOCKED}alcon.ae
- {BLOCKED}adomus.com
- {BLOCKED}eenrider.nl
- {BLOCKED}orusconsulting.net
- {BLOCKED}uiedager.com
- {BLOCKED}yandzac.com
- {BLOCKED}strifresh.com
- {BLOCKED}tiscapes-art.com
- {BLOCKED}achpreneuracademy.com
- {BLOCKED}tyoveges.com
- {BLOCKED}delitytitleoregon.com
- {BLOCKED}obbqchicken.ca
- {BLOCKED}encewho-aixenprovence.fr
- {BLOCKED}ueridgeheritage.com
- {BLOCKED}bbalucious.com
- {BLOCKED}tameble.pl
- {BLOCKED}lfclublandgoednieuwkerk.nl
- {BLOCKED}vermusic.nl
- {BLOCKED}vanced-removals.co.uk
- {BLOCKED}nida.it
- {BLOCKED}scinarosa33.it
- {BLOCKED}kfdyrehospital.dk
- {BLOCKED}dsegaard.dk
- {BLOCKED}counter-p.net
- {BLOCKED}waba-safaris.com
- {BLOCKED}zelle-du-web.com
- {BLOCKED}rsall.de
- {BLOCKED}sep2019.com
- 11.{BLOCKED}n.ua
- {BLOCKED}yvisionglobal.com
- {BLOCKED}lsupportco.com
- {BLOCKED}erplakky.nl
- {BLOCKED}bird.dk
- {BLOCKED}tor-durban.com
- {BLOCKED}ter-p.net
- {BLOCKED}ealth.net
- {BLOCKED}anboennelykke.dk
- {BLOCKED}mbh.com
- {BLOCKED}withleslie.com
- {BLOCKED}eper.li
- {BLOCKED}titutionalfunds.com
- {BLOCKED}saints.academy
- {BLOCKED}o.pro
- {BLOCKED}uhrambutkeiskei.com
- {BLOCKED}pieces-auto.fr
- {BLOCKED}guides.eu
- {BLOCKED}igns.com
- {BLOCKED}foto.dk
- {BLOCKED}vent.ru
- {BLOCKED}corting.com
- {BLOCKED}ssenreden.com
- {BLOCKED}ine.ru
- {BLOCKED}breaths.com
- {BLOCKED}elfairy.com
- {BLOCKED}roskitour.com
- {BLOCKED}hnologies.net
- {BLOCKED}mputers.com
- {BLOCKED}telyouth.com
- {BLOCKED}xbleus.net
- {BLOCKED}n.nl
- {BLOCKED}a.com.ua
- {BLOCKED}rgosbit-rp.ru
- {BLOCKED}nystar.com
- {BLOCKED}enne-styling.nl
- {BLOCKED}merslivinglively.com
- {BLOCKED}tomroasts.com
- {BLOCKED}oteamlast.de
- {BLOCKED}nsifer.fr
- {BLOCKED}erives-sur-vareze.fr
- {BLOCKED}neridgemontessori.com
- {BLOCKED}rgenblaetz.de
- {BLOCKED}-barn.co.uk
- {BLOCKED}verselle.fr
- {BLOCKED}fiz.com
- {BLOCKED}ielyn.com
- {BLOCKED}rlesfrancis.photos
- {BLOCKED}cargandoprogramas.com
- {BLOCKED}dmmusiccenter.com
- {BLOCKED}ide.com
- {BLOCKED}ydogslife.com
- {BLOCKED}igas.com
- {BLOCKED}kalflot.ru
- {BLOCKED}tch-n-bitch.com
- {BLOCKED}balloons.com
- {BLOCKED}ebusiness.com
- {BLOCKED}bible.org
- {BLOCKED}tgrinsteadwingchun.com
- {BLOCKED}ncanariaregional.com
- {BLOCKED}age-webzine.nl
- {BLOCKED}gestar.ch
- {BLOCKED}ced.com
- {BLOCKED}htenplicht.be
- {BLOCKED}ocrossplace.co.uk
- {BLOCKED}pycatering.de
- {BLOCKED}nlaw-okc.com
- {BLOCKED}camp.com
- {BLOCKED}-elec.com
- {BLOCKED}rtsalemap.com
- {BLOCKED}mccallum.com
- {BLOCKED}ovrienden.nl
- {BLOCKED}esa.com
- {BLOCKED}pylublog.wordpress.com
- {BLOCKED}ligemsehondenschool.be
- {BLOCKED}vi-vl.ru
- {BLOCKED}ehartman.nl
- {BLOCKED}esiberie.com
- {BLOCKED}tinipstudios.com
- {BLOCKED}ernalresults.com
- {BLOCKED}eroes.dk
- {BLOCKED}selbeton.nl
- {BLOCKED}ivfriskcenter.se
- {BLOCKED}rchier.org
- {BLOCKED}sette.com
- {BLOCKED}lish.ae
- {BLOCKED}ected-minds.de
- {BLOCKED}firstdelray.com
- {BLOCKED}dormobile.fr
- {BLOCKED}29010.it
- {BLOCKED}extimes.ru
- {BLOCKED}xplored.gr
- {BLOCKED}cinnatiphotocompany.org
- {BLOCKED}-frisor.dk
- {BLOCKED}al-pictures.com
- {BLOCKED}ssmoordental.com
- {BLOCKED}isghauri.com
- {BLOCKED}go.com
- {BLOCKED}m02pro.com
- {BLOCKED}nergo.eu
- {BLOCKED}inofhopeeurope.eu
- {BLOCKED}erpromote.de
- {BLOCKED}marabasin.com
- {BLOCKED}cermonticello.com
- {BLOCKED}mdalbygg.no
- {BLOCKED}-i-pure-impulse.com
- {BLOCKED}vselsguide.dk
- {BLOCKED}iahub.co.nz
- {BLOCKED}aysdc.com
- {BLOCKED}ernia-conseil.fr
- {BLOCKED}ecorp.com
- {BLOCKED}sunlimitedguide.com
- {BLOCKED}evannye.ru
- {BLOCKED}ohomes.com
- {BLOCKED}ajenedesigns.com
- {BLOCKED}sdoin-aquarelles.fr
- {BLOCKED}sionatblago.ru
- {BLOCKED}a.co.uk
- {BLOCKED}kapuu.net
- {BLOCKED}icademy.com
- {BLOCKED}skolinslimeffect.net
- {BLOCKED}akluckrecords.com
- {BLOCKED}ulz-moelln.de
- {BLOCKED}etech.academy
- {BLOCKED}dc.org
- {BLOCKED}4cdi.com
- {BLOCKED}perdanismanlik.com
- {BLOCKED}ectus.com
- {BLOCKED}mofficial.nl
- {BLOCKED}y-cloisons.fr
- {BLOCKED}pert99.com
- {BLOCKED}ova.sk
- {BLOCKED}olynfriedlander.com
- {BLOCKED}worx.de
- {BLOCKED}msegeln.ch
- {BLOCKED}ethicsport.eu
- {BLOCKED}sprettyhair.com
- {BLOCKED}lscars.net
- {BLOCKED}ctei.co
- {BLOCKED}dsparkescape.com
- {BLOCKED}denpartner.pl
- {BLOCKED}forsites.com
- {BLOCKED}dfuelers.com
- {BLOCKED}ncacu.com
- {BLOCKED}cisetemp.com
- {BLOCKED}brazil.com
- {BLOCKED}osindustries.com
- {BLOCKED}kacare.com
- {BLOCKED}-horlogerie.com
- {BLOCKED}ernestdigital.com
- {BLOCKED}verwynkoopdentist.com
- {BLOCKED}cuit-diagramz.com
- {BLOCKED}yanakopieva.ru
- {BLOCKED}itudeboise.com
- {BLOCKED}amode.com
- {BLOCKED}memyballs.com
- {BLOCKED}group.pt
- {BLOCKED}guyentuan.com
- {BLOCKED}ndatwentytwenty.com
- {BLOCKED}nkdoepke.eu
- {BLOCKED}weringsun.org
- {BLOCKED}kbuilding.life
- {BLOCKED}manson.com
- {BLOCKED}ut.online
- {BLOCKED}scanner.ro
- {BLOCKED}standingminialbums.com
- {BLOCKED}zar.com
- {BLOCKED}poniasafaris.com
- {BLOCKED}deevents.be
- {BLOCKED}rttourism.academy
- {BLOCKED}hardbrickwork.com
- {BLOCKED}ershell.su
- {BLOCKED}dhpest.com
- {BLOCKED}rlottelhanna.com
- {BLOCKED}iveterroristwarningcompany.com
- {BLOCKED}pusescalade.com
- {BLOCKED}ecologicos.com
- {BLOCKED}land.ru
- {BLOCKED}atek.com
- {BLOCKED}tconf.com
- {BLOCKED}starvation.com
- {BLOCKED}ge-infirmier.fr
- {BLOCKED}es-geldvergleich.de
- {BLOCKED}lg24.online
- {BLOCKED}rtworkplaza.com
- {BLOCKED}gboerderijravensbosch.nl
- {BLOCKED}rello.nl
- {BLOCKED}terscan.de
- {BLOCKED}ns.com
- {BLOCKED}mier-iowa.com
- {BLOCKED}a-france.fr
- {BLOCKED}tfeldt.dk
- {BLOCKED}battoirs.org
- {BLOCKED}zel.tn
- {BLOCKED}dan.com
- {BLOCKED}lessrealms.net
- {BLOCKED}ater-lueneburg.de
- {BLOCKED}bap.de
- {BLOCKED}uskontur.com
- {BLOCKED}itale-elite.de
- {BLOCKED}nazepamblog.com
- {BLOCKED}zytana.com
- {BLOCKED}jyuku-sozoku.com
- {BLOCKED}boardroomafrica.com
- {BLOCKED}ama.ac
- {BLOCKED}ngmehope.org
- {BLOCKED}onestop.com
- {BLOCKED}candy.com
- {BLOCKED}auchs-wanderlust.info
- {BLOCKED}lunkartano.fi
- {BLOCKED}tallabor-luenen.de
- {BLOCKED}tberlin.de
- {BLOCKED}-international.com
- {BLOCKED}grinningmanmusical.com
- {BLOCKED}id5kloan.org
- {BLOCKED}tourage.com
- {BLOCKED}vait.fr
- {BLOCKED}nsonweekly.com
- {BLOCKED}quercy.fr
- {BLOCKED}n.ru
- {BLOCKED}iniumacademy.com
- {BLOCKED}-ziinoapte-6ld.ro
- {BLOCKED}rlabretagne.bzh
- {BLOCKED}tuindonesia.com
- {BLOCKED}leshopping.it
- {BLOCKED}ensed-public-adjuster.com
- {BLOCKED}egoodfellow.co.uk
- {BLOCKED}centers.com
- {BLOCKED}slaw-narty.pl
- {BLOCKED}tastoy.store
- {BLOCKED}en-praxisklinik-rostock.de
- {BLOCKED}o-opel.ro
- {BLOCKED}nleyqualitysystems.com
- {BLOCKED}elika-schwarz.com
- {BLOCKED}star.com
- {BLOCKED}eghlim.com
- {BLOCKED}rdeenartwalk.org
- {BLOCKED}ntosvirtualesexitosos.com
- {BLOCKED}nodi.be
- {BLOCKED}luttz.com
- {BLOCKED}-80abehgab4ak0ddz.xn--p1ai
- {BLOCKED}madolhealth.com
- {BLOCKED}paperwork.eu
- {BLOCKED}ectique.com
- {BLOCKED}2040.com
- {BLOCKED}ildinghomes.com
- {BLOCKED}comedical.de
- {BLOCKED}estors.org
- {BLOCKED}nyhooley.com
- {BLOCKED}tterchatterchatter.com
- {BLOCKED}presory-opravy.com
- {BLOCKED}roprime.com
- {BLOCKED}menconsultingcompany.com
- {BLOCKED}acheck.co.za
- {BLOCKED}ygreenbiomedservices.com
- {BLOCKED}elsmirrorus.com
- {BLOCKED}ohn.de
- {BLOCKED}lgrinderpt.com
- {BLOCKED}chbiz.com
- {BLOCKED}nstitute.org
- {BLOCKED}xwenzel.de
- {BLOCKED}arage.com
- {BLOCKED}iplan.ru
- {BLOCKED}s4causes.org
- {BLOCKED}intellect.edu.pk
- {BLOCKED}gen.com
- {BLOCKED}ndseeing.net
- {BLOCKED}staffing.com
- {BLOCKED}iabolmong.com
- {BLOCKED}eltantra.com
- {BLOCKED}ema.gr
- {BLOCKED}in-somnium.de
- {BLOCKED}chwoodmarketing.com
- {BLOCKED}ten-vochtbestrijding.be
- {BLOCKED}tofurniture.com
- {BLOCKED}taroundthecornerpetsit.com
- {BLOCKED}ubrybak.com
- go.{BLOCKED}ni.ch
- {BLOCKED}illionaires.net
- {BLOCKED}yagro.com.ua
- {BLOCKED}uralhousingstudies.org
- {BLOCKED}l.it
- {BLOCKED}covka.ru
- {BLOCKED}se.com
- {BLOCKED}i.ru
- {BLOCKED}eiligenstadt.de
- {BLOCKED}iksy.net
- {BLOCKED}holics.in
- {BLOCKED}serei-hannover.de
- {BLOCKED}rvisions-id.com
- {BLOCKED}rium.com
- {BLOCKED}herbalhealth.com
- {BLOCKED}rugcleaningnyc.com
- {BLOCKED}others.com
- {BLOCKED}-saint-flour.fr
- {BLOCKED}abitare.com
- {BLOCKED}ystownhouse.com
- {BLOCKED}enmattgarage.ch
- {BLOCKED}gostar.co
- {BLOCKED}isacteur.fr
- {BLOCKED}supremegarcinia.net
- {BLOCKED}iasmali.net
- {BLOCKED}orgenstern.com
- {BLOCKED}digmlandscape.com
- {BLOCKED}ilkroadny.com
- {BLOCKED}thebettertolivebetter.com
- {BLOCKED}erinealy.com
- {BLOCKED}tamovers.com
- {BLOCKED}forest.net
- {BLOCKED}inya.net
- {BLOCKED}eados.com
- {BLOCKED}ec-international.es
- {BLOCKED}ebizadvocates.org
- {BLOCKED}anmarketing.com
- {BLOCKED}matelifesource.com
- {BLOCKED}etawaycollective.com
- {BLOCKED}drivingschool.com.au
- {BLOCKED}a.plus
- {BLOCKED}eshift.it
- {BLOCKED}lakatjaya.com
- {BLOCKED}royals.com
- {BLOCKED}vedealers.ru
- {BLOCKED}stopsmoking.co.uk
- {BLOCKED}us.ca
- {BLOCKED}xtherapy.site
- {BLOCKED}la.dk
- {BLOCKED}ngismyyoga.com
- {BLOCKED}gruppe.ch
- {BLOCKED}ialtyhomeservicesllc.com
- {BLOCKED}alta.com
- {BLOCKED}hieupetel.fr
- {BLOCKED}alpa.com
- {BLOCKED}pinger-teppichreinigung.de
- {BLOCKED}dersnapsen.dk
- {BLOCKED}renetworking.com
- {BLOCKED}tg.org
- {BLOCKED}ntcoach.com
- {BLOCKED}thebell.website
- {BLOCKED}slubna.com
- {BLOCKED}ogz.de
- {BLOCKED}gus.fr
- {BLOCKED}aonline.com
- {BLOCKED}nda.af
- {BLOCKED}davisphotos.com
- {BLOCKED}koen.com
- {BLOCKED}ppi.fi
- {BLOCKED}ienessa.com
- {BLOCKED}tzuchia.com
- {BLOCKED}nce-refle.com
- {BLOCKED}virksomhed.dk
- {BLOCKED}k.digital
- {BLOCKED}javertailut.net
- {BLOCKED}upe.com
- {BLOCKED}ndchallenger.com
- {BLOCKED}e.com
- {BLOCKED}encyconsulting.es
- {BLOCKED}endsgoal.site
- {BLOCKED}cristescu.com
- {BLOCKED}rcashsystem.com
- {BLOCKED}a.com
- {BLOCKED}tter.nl
- {BLOCKED}eniste.com
- {BLOCKED}tdecor.com
- {BLOCKED}osextras.online
- {BLOCKED}e-entertainment.com
- {BLOCKED}victoria.com
- {BLOCKED}u.futbol
- {BLOCKED}-landliebe.de
- {string 1}:
- wp-content
- include
- content
- uploads
- static
- admin
- data
- news
- {string 2}:
- images
- pictures
- image
- temp
- tmp
- graphic
- assets
- pics
- game
- {string 3}:
- jpg
- png
- gif
ランサムウェアの不正活動
マルウェアは、ファイル名に以下の文字列を含むファイルの暗号化はしません。
- File extensions:
- key
- shs
- 386
- lnk
- cur
- ocx
- nomedia
- rtp
- msstyles
- msu
- rom
- hlp
- scr
- theme
- exe
- msc
- wpx
- lock
- ico
- bat
- cab
- adv
- diagcfg
- idx
- cpl
- dll
- ps1
- mod
- msp
- themepack
- bin
- ics
- msi
- diagcab
- ani
- nls
- com
- ldf
- deskthemep
- prf
- spl
- hta
- mpa
- sys
- icl
- icns
- cmd
- drv
- diagpkg
- File name:
- ntuser.ini
- autorun.inf
- bootsect.bak
- ntldr
- ntuser.dat.log
- ntuser.dat
- bootfont.bin
- iconcache.db
- thumbs.db
- boot.ini
- desktop.ini
マルウェアは、以下のフォルダ内で確認されたファイルの暗号化はしません。
- msocache
- $recycle.bin
- perflogs
- intel
- boot
- mozilla
- tor browser
- $windows.~bt
- windows
- windows.old
- $windows.~ws
- application data
- system volume information
- appdata
マルウェアは、暗号化されたファイルのファイル名に以下の拡張子を追加します。
- .{random characters}
マルウェアが作成する以下のファイルは、脅迫状です。
- {encrypted folder}\{appended ransom extension}-readme.txt
マルウェアは、以下の内容を含む脅迫状のテキストファイルを残します。
対応方法
手順 1
トレンドマイクロの機械学習型検索は、マルウェアの存在を示す兆候が確認された時点で検出し、マルウェアが実行される前にブロックします。機械学習型検索が有効になっている場合、弊社のウイルス対策製品はこのマルウェアを以下の機械学習型検出名として検出します。
-
Troj.Win32.TRX.XXPE50FFF032
手順 2
Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。
手順 3
このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム(OS)の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル/フォルダ/レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。
手順 4
Windowsをセーフモードで再起動します。
手順 5
「Ransom.Win32.SODINOKIBI.ASDKI」で検出したファイル名を確認し、そのファイルを終了します。
- すべての実行中プロセスが、Windows のタスクマネージャに表示されない場合があります。この場合、"Process Explorer" などのツールを使用しマルウェアのファイルを終了してください。"Process Explorer" については、こちらをご参照下さい。
- 検出ファイルが、Windows のタスクマネージャまたは "Process Explorer" に表示されるものの、削除できない場合があります。この場合、コンピュータをセーフモードで再起動してください。
セーフモードについては、こちらをご参照下さい。 - 検出ファイルがタスクマネージャ上で表示されない場合、次の手順にお進みください。
手順 6
不明なレジストリキーを削除します。
警告:レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。
手順 7
以下のファイルを検索し削除します。
- %User Temp%\{random characters}.bmp → ransom wallpaper
- {encrypted folder}\{appended ransom extension}-readme.txt → ransom note
手順 8
デスクトッププロパティを修正します。
手順 12
コンピュータを通常モードで再起動し、最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、「Ransom.Win32.SODINOKIBI.ASDKI」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
手順 13
最新のバージョン(エンジン、パターンファイル)を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「Ransom.Win32.SODINOKIBI.ASDKI」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。
ご利用はいかがでしたか? アンケートにご協力ください