解析者: Clive Fuentebella   
 別名:

N/A

 プラットフォーム:

Windows

 危険度:
 ダメージ度:
 感染力:
 感染確認数:
 情報漏えい:

  • マルウェアタイプ:
    身代金要求型不正プログラム（ランサムウェア）

  • 破壊活動の有無:
    なし

  • 暗号化:
    はい

  • 感染報告の有無 :
    はい

  概要

感染経路 他のマルウェアからの作成, インターネットからのダウンロード

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

身代金要求文書のファイルを作成します。 以下のファイル拡張子を持つファイルは暗号化しません。

  詳細

ファイルサイズ 1,373,641 bytes
タイプ PS1
メモリ常駐 はい
発見日 2020年7月29日
ペイロード ファイルの作成, プロセスの強制終了, メッセージボックスの表示, 情報収集

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のファイルを作成します。

  • %User Temp%\{Random characters}.bmp

(註：%User Temp%フォルダは、現在ログオンしているユーザの一時フォルダです。Windows 2000(32-bit)、XP、Server 2003(32-bit)の場合、通常 "C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"です。また、Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit)の場合、通常 "C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。)

マルウェアは、以下のプロセスを追加します。

  • powershell -e {Base-64 encoded command} (to delete shadow copies)

プロセスの終了

マルウェアは、感染コンピュータ上でプロセスが常駐されていることを確認した場合、以下のいずれかの文字列を含むプロセスまたはサービスを終了します。

  • mysql
  • mepocs
  • veeam
  • vss
  • backup
  • sql
  • memtas
  • sophos
  • svc$l

情報漏えい

トロイの木馬化されたアプリケーションが実行されると、[Malware]は、以下の情報を収集します。

  • Username
  • Computer name
  • Operating system
  • Processor information
  • Workgroup

情報収集

マルウェアは、HTTPポスト を介して、収集した情報を以下のURLに送信します。

  • https://{Domain}/{String 1}/{String 2}/{Random characters}
    • Domain:
      • {BLOCKED}howard.com
      • {BLOCKED}.com
      • {BLOCKED}etxinh.com
      • {BLOCKED}visions.com
      • {BLOCKED}our-life.jp
      • {BLOCKED}thuset.dk
      • {BLOCKED}odea.com
      • {BLOCKED}lbridgeadvisors.com
      • {BLOCKED}nnheim.de
      • {BLOCKED}ill.guru
      • {BLOCKED}alentineacademy.com
      • {BLOCKED}grasoweb.com
      • {BLOCKED}d-felix.co.uk
      • {BLOCKED}blum.info
      • {BLOCKED}2-aid-u.com
      • {BLOCKED}osting.net
      • {BLOCKED}campingdoonbeg.com
      • {BLOCKED}rtriebsforschung.de
      • {BLOCKED}ar.co.uk
      • {BLOCKED}ri-pizzeria.de
      • {BLOCKED}opioidworkgroup.org
      • {BLOCKED}state-experts.com
      • {BLOCKED}ter.nl
      • {BLOCKED}icapublica.es
      • {BLOCKED}loogia.ee
      • {BLOCKED}-chocolat-noir.com
      • {BLOCKED}.jp
      • {BLOCKED}-autoimport.nl
      • {BLOCKED}ondition.com
      • {BLOCKED}.org
      • {BLOCKED}g.com
      • (BLOCKED)g.net
      • {BLOCKED}osanitario.biz
      • (BLOCKED}f.info
      • {BLOCKED}nbeach-realestate.com
      • {BLOCKED}r.com
      • {BLOCKED}ni.com
      • {BLOCKED}gratuitosnainternet.com
      • {BLOCKED}cocom.fr
      • {BLOCKED}tspraktijkheesch.nl
      • {BLOCKED}erein-tambach.de
      • {BLOCKED}empore.net
      • {BLOCKED}ttabernacle.com
      • {BLOCKED}amezone.com
      • {BLOCKED}nskarna.se
      • {BLOCKED}orativeclassroom.org
      • {BLOCKED}SellsHomes.com
      • {BLOCKED}gehousesalonvt.com
      • {BLOCKED}marketing.com
      • {BLOCKED}oliveira.com
      • {BLOCKED}i.net
      • {BLOCKED}-wood.com
      • {BLOCKED}dgemuseumbd.com
      • serce.{BLOCKED}o.pl
      • {BLOCKED}-kids.info
      • {BLOCKED}loud.hk
      • {BLOCKED}en.de
      • {BLOCKED}szervizbudapest.hu
      • {BLOCKED}kellari.fi
      • {BLOCKED}uthclothingcompany.com
      • {BLOCKED}ick.com
      • {BLOCKED}aby.com
      • {BLOCKED}ietdichter.nl
      • {BLOCKED}sasdigest.com
      • {BLOCKED}w.com
      • {BLOCKED}yc.co
      • {BLOCKED}easterimages.org
      • {BLOCKED}d.de
      • {BLOCKED}.com
      • {BLOCKED}asternacademyofprosthodontics.org
      • {BLOCKED}marketingstrategies.com
      • {BLOCKED}ipur.com
      • {BLOCKED}parbariatrics.com
      • {BLOCKED}.com.au
      • {BLOCKED}irc.net
      • {BLOCKED}ast.se
      • {BLOCKED}rvices.de
      • {BLOCKED}-home.com
      • {BLOCKED}recision.co.uk
      • {BLOCKED}get.com
      • {BLOCKED}iousfestival.co.uk
      • {BLOCKED}feststaefa.ch
      • {BLOCKED}.fi
      • {BLOCKED}studio.com
      • {BLOCKED}chise.com
      • {BLOCKED}-machine.com
      • {BLOCKED}alforce.net
      • {BLOCKED}romelabs.com
      • {BLOCKED}nglebrsen-vergleich-nec.com
      • {BLOCKED}hate.org
      • {BLOCKED}firm.com
      • {BLOCKED}-delom.ru
      • {BLOCKED}rmachen.com
      • {BLOCKED}nyon.com
      • {BLOCKED}lhammer.com
      • {BLOCKED}eseidel.com
      • {BLOCKED}erweldingllc.com
      • {BLOCKED}clubetten.nl
      • {BLOCKED}bogatyr.ru
      • {BLOCKED}adband.com
      • {BLOCKED}unnan.se
      • {BLOCKED}idascostablanca.es
      • {BLOCKED}erage.com.au
      • {BLOCKED}a.es
      • {BLOCKED}irius.de
      • {BLOCKED}dentists.com
      • {BLOCKED}nsedwards.co.uk
      • {BLOCKED}org
      • {BLOCKED}ggroup.com
      • {BLOCKED}bird.salon
      • {BLOCKED}.com
      • {BLOCKED}es
      • {BLOCKED}tyfmm.com
      • {BLOCKED}lobalduz.es
      • {BLOCKED}ndoc.com
      • {BLOCKED}lt
      • {BLOCKED}ybrid.com.au
      • {BLOCKED}al.ru
      • {BLOCKED}chance.se
      • {BLOCKED}count.at
      • {BLOCKED}store.com
      • {BLOCKED}-opera.de
      • {BLOCKED}sitze-vergleich.de
      • {BLOCKED}ny-dywan24.pl
      • {BLOCKED}cay.com.ar
      • {BLOCKED}vieira.com
      • {BLOCKED}nightdc.com
      • {BLOCKED}tedace.com
      • {BLOCKED}.com
      • {BLOCKED}netunnel.com
      • {BLOCKED}ir.com
      • {BLOCKED}ter.company
      • {BLOCKED}park40.com
      • {BLOCKED}jack-llc.com
      • {BLOCKED}e.at
      • {BLOCKED}nternet.it
      • {BLOCKED}us.eu
      • {BLOCKED}.site
      • {BLOCKED}leyministries.com
      • {BLOCKED}.lt
      • {BLOCKED}thelender.com
      • {BLOCKED}com.sg
      • {BLOCKED}botter.com
      • {BLOCKED}-shihou.com
      • {BLOCKED}ncesalextrespaille.fr
      • {BLOCKED}onemedia.com
      • {BLOCKED}s
      • {BLOCKED}foodsgroup.com
      • {BLOCKED}d.de
      • {BLOCKED}kchurch.org
      • {BLOCKED}o.pl
      • {BLOCKED}ngharnosand.se
      • {BLOCKED}eesurveys.com
      • {BLOCKED}rus-ratgeber.de
      • {BLOCKED}u
      • {BLOCKED}mung-bua.online
      • {BLOCKED}oberts.co.nz
      • {BLOCKED}ekturbuero-wagner.net
      • {BLOCKED}er.com
      • {BLOCKED}eopleplaces.com
      • {BLOCKED}tlet.com
      • {BLOCKED}chwartz.wordpress.com
      • {BLOCKED}n.com
      • {BLOCKED}e.org
      • {BLOCKED}rantesszimmer.de
      • {BLOCKED}yggen.se
      • {BLOCKED}ms.london
      • {BLOCKED}wityu.fund
      • {BLOCKED}luku.com
      • {BLOCKED}ybacktolife.com
      • {BLOCKED}reehouse.net
      • {BLOCKED}pedebroca.com
      • {BLOCKED}ris.com
      • {BLOCKED}nova.wordpress.com
      • {BLOCKED}en-bauer.at
      • {BLOCKED}ja.com
      • {BLOCKED}pecialisten.se
      • {BLOCKED}att.no
      • {BLOCKED}g.netgateway.eu
      • {BLOCKED}-management-plus.de
      • {BLOCKED}oundation.org
      • {BLOCKED}uru
      • {BLOCKED}.de
      • {BLOCKED}ney-cox.net
      • {BLOCKED}-undwieweiter.de
      • {BLOCKED}mtn.com
      • {BLOCKED}com
      • {BLOCKED}nstela.com
      • {BLOCKED}anson.com
      • {BLOCKED}onk.online
      • {BLOCKED}blessedbykeepingitreal.com
      • {BLOCKED}kustomz.com
      • {BLOCKED}roup.com.au
      • {BLOCKED}.site
      • {BLOCKED}f-mobayl.ru
      • {BLOCKED}yday-loans.com
      • {BLOCKED}rtles.com
      • {BLOCKED}neider.info
      • {BLOCKED}o.in
      • {BLOCKED}ullah.com
      • {BLOCKED}dias.com
      • {BLOCKED}ursery.com
      • {BLOCKED}thebrand.com
      • {BLOCKED}odestates.org
      • {BLOCKED}r-factory.co.jp
      • {BLOCKED}err.co.uk
      • {BLOCKED}ru
      • {BLOCKED}.pro
      • {BLOCKED}upro.com
      • {BLOCKED}ational-sound-awards.com
      • {BLOCKED}biester.de
      • {BLOCKED}ownideamill.wordpress.com
      • {BLOCKED}ctiv-shop.ru
      • {BLOCKED}sterputssollentuna-39b.se
      • {BLOCKED}graphic.com
      • {BLOCKED}rmacpc.com
      • {BLOCKED}-trails.com
      • {BLOCKED}sort.com
      • {BLOCKED}ryogacharlotte.com
      • {BLOCKED}lnessmimi.com
      • {BLOCKED}.de
      • {BLOCKED}-lecompte-rouen.fr
      • {BLOCKED}wer.at
      • {BLOCKED}stions.org
      • {BLOCKED}owers.ru
      • {BLOCKED}org
      • {BLOCKED}uissibomana.com
      • {BLOCKED}den.com
      • {BLOCKED}bolanet.info
      • {BLOCKED}lrapids.com
      • {BLOCKED}e.no
      • {BLOCKED}i
      • {BLOCKED}-bamboo-bikes.org
      • {BLOCKED}fr
      • {BLOCKED}tein-hotte.de
      • {BLOCKED}ngiteexperience.com.au
      • {BLOCKED}g.de
      • {BLOCKED}tspraktijkhartjegroningen.nl
      • {BLOCKED}.hn
      • {BLOCKED}montagenijmegen.nl
      • {BLOCKED}arvalhoerodrigues.com.br
      • {BLOCKED}ediastrategies.com
      • {BLOCKED}at.com
      • {BLOCKED}genius.com
      • {BLOCKED}says.net
      • {BLOCKED}fr
      • {BLOCKED}tsumba.nl
      • {BLOCKED}.at
      • {BLOCKED}nters-in-europe.com
      • {BLOCKED}ign.com
      • {BLOCKED}oralmedicinespecialists.com
      • {BLOCKED}iapsicologia.es
      • {BLOCKED}illedentistry.com
      • {BLOCKED}rdenstudentcity.nl
      • {BLOCKED}ive.de
      • {BLOCKED}aking.nl
      • {BLOCKED}whitten.site
      • {BLOCKED}rgamila.com
      • {BLOCKED}ingsulweb.com
      • {BLOCKED}roductkey.com
      • {BLOCKED}bf.com
      • {BLOCKED}org.au
      • {BLOCKED}outique247.com
      • {BLOCKED}cloud.com
      • {BLOCKED}hcenter.de
      • {BLOCKED}k.ru
      • {BLOCKED}.com
      • {BLOCKED}ditioning-waalwijk.nl
      • {BLOCKED}pepper.gives
      • {BLOCKED}cinnovations.com
      • {BLOCKED}cel.com
      • {BLOCKED}ofessional.ru
      • {BLOCKED}ypartners.nl
      • {BLOCKED}.ru
      • {BLOCKED}119.com
      • {BLOCKED}gewerkschaften.de
      • {BLOCKED}marcomdotcom.wordpress.com
      • {BLOCKED}ps.se
      • {BLOCKED}escom.wordpress.com
      • {BLOCKED}ienda.com
      • {BLOCKED}dache.com
      • {BLOCKED}chi.ru
      • {BLOCKED}icmusicfest.com
      • {BLOCKED}ekupper.com
      • {BLOCKED}taforum.com
      • {BLOCKED}ntofue.it
      • {BLOCKED}c.com
      • {BLOCKED}na.com
      • {BLOCKED}trobos.com
      • {BLOCKED}lds.org
      • {BLOCKED}eed.com
      • {BLOCKED}ihreat.fi
      • {BLOCKED}grafica.es
      • {BLOCKED}ighscoutgroup.org
      • {BLOCKED}nline.com
      • {BLOCKED}hule-kieber.de
      • {BLOCKED}aetstag.de
      • {BLOCKED}itte.co.at
      • {BLOCKED}pasch.me
      • {BLOCKED}auretra.es
      • {BLOCKED}.gr
      • {BLOCKED}hut.com
      • {BLOCKED}matepro.com.au
      • {BLOCKED}ngbonanza.com
      • {BLOCKED}singbyjessica.com
      • {BLOCKED}reamingvfcomplet.be
      • {BLOCKED}gringo.com
      • {BLOCKED}ieperry.com
      • {BLOCKED}fplus.com
      • {BLOCKED}ink.net
      • {BLOCKED}escorecard.com
      • {BLOCKED}.com
      • {BLOCKED}com
      • {BLOCKED}reetauto.net
      • {BLOCKED}s.dk
      • {BLOCKED}ofpassivewealth.com
      • {BLOCKED}de
      • {BLOCKED}erg.fi
      • {BLOCKED}viser.com
      • {BLOCKED}nfo.tr
      • {BLOCKED}boulga.net
      • {BLOCKED}se.com
      • {BLOCKED}ttepoudroux-photographie.fr
      • {BLOCKED}ngbee.com
      • {BLOCKED}kowalsky.com
      • {BLOCKED}zmann.com
      • {BLOCKED}nd-sloboda.com
      • {BLOCKED}in.com
      • {BLOCKED}ion.com
      • {BLOCKED}tesdemean.be
      • {BLOCKED}yfreightservices.com.au
      • {BLOCKED}troy72.com
      • {BLOCKED}rrior.app
      • {BLOCKED}-krueger.de
      • {BLOCKED}org
      • {BLOCKED}-handles.com
      • {BLOCKED}enreich27.de
      • {BLOCKED}and24.de
      • {BLOCKED}c.es
      • {BLOCKED}ado.de
      • {BLOCKED}fenutrition.com
      • {BLOCKED}xa.cat
      • {BLOCKED}lan.info
      • {BLOCKED}racoles.com
      • {BLOCKED}deine-marke.de
      • {BLOCKED}ox.com
      • {BLOCKED}ta.com
      • {BLOCKED}oard.info
      • {BLOCKED}hawessels.com
      • {BLOCKED}ollmann.de
      • {BLOCKED}itysisters.org
      • {BLOCKED}com
      • {BLOCKED}omsportfondsen.nl
      • {BLOCKED}interieurprojecten.nl
      • {BLOCKED}nha.com.vn
      • {BLOCKED}ct.co.uk
      • {BLOCKED}garage.pl
      • {BLOCKED}cht.de
      • {BLOCKED}acioesportivapolitg.cat
      • {BLOCKED}ktro.nl
      • {BLOCKED}voor-baby.nl
      • {BLOCKED}do.nl
      • {BLOCKED}.fi
      • {BLOCKED}mebel63.ru
      • {BLOCKED}ourconstruction.com
      • {BLOCKED}gleitlager.de
      • {BLOCKED}rradler.de
      • {BLOCKED}erandersonwriter.com
      • {BLOCKED}.fr
      • {BLOCKED}tore.com
      • {BLOCKED}theloveofyou.com
      • {BLOCKED}ardechina.info
      • {BLOCKED}mily.construction
      • {BLOCKED}re.de
      • {BLOCKED}eznev.com
      • {BLOCKED}olbh.com.br
      • {BLOCKED}homedogrescue.dog
      • {BLOCKED}telefon.hr
      • {BLOCKED}gsunderlebnis.haus
      • {BLOCKED}.com
      • {BLOCKED}ojekt.com
      • {BLOCKED}.com
      • {BLOCKED}rbosa.com
      • {BLOCKED}iv-industry.fr
      • {BLOCKED}essor.com
      • {BLOCKED}-decor.ru
      • {BLOCKED}.ua
      • {BLOCKED}een-fishing.com
      • {BLOCKED}afirstcommittee.org
      • {BLOCKED}aybeach.com
      • {BLOCKED}main-trader.com
      • {BLOCKED}uethi-allart.ch
      • {BLOCKED}cs.com
      • {BLOCKED}ing.nl
      • {BLOCKED}amber.com
      • {BLOCKED}l.com
      • {BLOCKED}coaching.fr
      • {BLOCKED}rend.pl
      • {BLOCKED}hesterescorts.co.uk
      • {BLOCKED}herefordshire-pc.gov.uk
      • {BLOCKED}la-dr-sturm.at
      • {BLOCKED}er.com
      • {BLOCKED}teconstruct.be
      • {BLOCKED}-kanto.com
      • {BLOCKED}entmd.org
      • {BLOCKED}ngay.com
      • {BLOCKED}ns.net
      • {BLOCKED}t.com
      • {BLOCKED}udy.com
      • {BLOCKED}c.com
      • {BLOCKED}ck.com
      • {BLOCKED}an.de
      • {BLOCKED}ratica.com
      • {BLOCKED}anieprzedszkolne.pl
      • {BLOCKED}psy.fr
      • {BLOCKED}el-paysage.fr
      • {BLOCKED}merawilltravel2017.wordpress.com
      • {BLOCKED}tauscher-berechnen.de
      • {BLOCKED}online.com
      • {BLOCKED}lyon.com
      • {BLOCKED}kraine.com.ua
      • {BLOCKED}g.com
      • {BLOCKED}oolfun.net
      • {BLOCKED}celiptv.com
      • {BLOCKED}anagement.de
      • {BLOCKED}-cosmetics.at
      • {BLOCKED}stilte.nl
      • {BLOCKED}iapmg.com
      • {BLOCKED}octor.org
      • {BLOCKED}ack.de
      • {BLOCKED}uards.it
      • {BLOCKED}info
      • {BLOCKED}teweddingkansas.com
      • {BLOCKED}etwork
      • {BLOCKED}tingsrbija.rs
      • {BLOCKED}ointefellowship.church
      • {BLOCKED}creatives.nl
      • {BLOCKED}ationclients.fr
      • {BLOCKED}an.com
      • {BLOCKED}ury.com
      • {BLOCKED}chooldezonnewijzer.nl
      • {BLOCKED}roresult.no
      • {BLOCKED}pacios.com
      • {BLOCKED}dolls.com
      • {BLOCKED}ose.com
      • {BLOCKED}-lemm.de
      • {BLOCKED}ezingmachines.com
      • {BLOCKED}dsspar.se
      • {BLOCKED}
      • {BLOCKED}ia.vn
      • {BLOCKED}iveairllc.com
      • {BLOCKED}on.com
      • {BLOCKED}denbollnas.se
      • {BLOCKED}ra.com
      • {BLOCKED}eisincome.com
      • {BLOCKED}r
      • {BLOCKED}mark.dk
      • {BLOCKED}meworkhelp.com
      • {BLOCKED}re.com
      • {BLOCKED}act.com
      • {BLOCKED}achineryauctions.com
      • {BLOCKED}cafe.com
      • {BLOCKED}edges.com
      • {BLOCKED}com
      • {BLOCKED}loanslenders.com
      • {BLOCKED}rmour.online
      • {BLOCKED}s-gruppe.de
      • {BLOCKED}broch.com
      • {BLOCKED}y.com.hk
      • {BLOCKED}kfoundation.net
      • {BLOCKED}s.ch
      • {BLOCKED}erpd.com
      • {BLOCKED}wealth.com
      • {BLOCKED}anservicescourses.com
      • {BLOCKED}-frayssinet.fr
      • {BLOCKED}olutionsarchitect.guru
      • {BLOCKED}.no
      • {BLOCKED}arthstudio.com
      • {BLOCKED}et
      • {BLOCKED}ncy.com
      • {BLOCKED}ptfordbuyrite.com
      • {BLOCKED}ator-oszczednosci.pl
      • {BLOCKED}st.nl
      • {BLOCKED}inangberdaya.com
      • {BLOCKED}e.org.gt
      • {BLOCKED}s.group
      • {BLOCKED}iminaltribe.wordpress.com
      • {BLOCKED}gls.com
      • {BLOCKED}castings.co.uk
      • {BLOCKED}ergeyeclinic.com.au
      • {BLOCKED}lsmeriglioracing.com
      • {BLOCKED}cklink.com
      • {BLOCKED}nl
      • {BLOCKED}lakeuca.org.au
      • {BLOCKED}utaylor.com
      • {BLOCKED}lose-webcams.com
      • {BLOCKED}za.com
      • {BLOCKED}o.com.pl
      • {BLOCKED}osaccidentetraficosevilla.es
      • {BLOCKED}alents.com
      • {BLOCKED}jos.lt
      • {BLOCKED}rbau-ziegler.de
      • {BLOCKED}vicino.com
      • {BLOCKED}rie.com
      • {BLOCKED}nesouthasc.com
      • {BLOCKED}hwords.net
      • {BLOCKED}tytenfold.com
      • {BLOCKED}p.org
      • {BLOCKED}ag.com
      • {BLOCKED}b.com
      • {BLOCKED}management.com
      • {BLOCKED}avid.com
      • {BLOCKED}aeschbachorg.wordpress.com
      • {BLOCKED}evue.fr
      • {BLOCKED}-a-service.com
      • {BLOCKED}nd-thermen-resort.com
      • {BLOCKED}horst.de
      • {BLOCKED}stinglab.com
      • {BLOCKED}rswithlena.wordpress.com
      • {BLOCKED}at
      • {BLOCKED}use.net
      • {BLOCKED}modsapks.com
      • {BLOCKED}ataamo.fi
      • {BLOCKED}eting.co.uk
      • {BLOCKED}ithatgo.com
      • {BLOCKED}atives.co
      • {BLOCKED}em.net
      • {BLOCKED}us.com
      • {BLOCKED}ws.jp
      • {BLOCKED}ad-direkt.de
      • {BLOCKED}olen.co.uk
      • {BLOCKED}ate.dk
      • {BLOCKED}irche-gera.de
      • {BLOCKED}e
      • {BLOCKED}.cn
      • {BLOCKED}inghealthbenefits.com
      • {BLOCKED}grasa.net
      • {BLOCKED}.co
      • {BLOCKED}dia
      • {BLOCKED}s.org
      • {BLOCKED}automation.de
      • {BLOCKED}rhealth.live
      • {BLOCKED}naclubedeportugal.com
      • {BLOCKED}wis.pl
      • {BLOCKED}immobilien.de
      • {BLOCKED}ecturalfiberglass.org
      • {BLOCKED}noway.com
      • {BLOCKED}efritid.dk
      • {BLOCKED}lesspromo.com
      • {BLOCKED}gfpt.info.vn
      • {BLOCKED}uchmassage.com
      • {BLOCKED}.de
      • {BLOCKED}nl
      • {BLOCKED}ise.de
      • {BLOCKED}sserie.com
      • {BLOCKED}o.biz
      • {BLOCKED}thlaw.com
      • {BLOCKED}layertest.net
      • {BLOCKED}oldriving.com
      • {BLOCKED}.com
      • {BLOCKED}ic-technologies.com
      • {BLOCKED}ngminds.wordpress.com
      • {BLOCKED}tberedare.se
      • {BLOCKED}forall.org
      • {BLOCKED}n.ag
      • {BLOCKED}lovakia.sk
      • {BLOCKED}idedvisit.com
      • {BLOCKED}sobancario.net
      • {BLOCKED}.net
      • {BLOCKED}ay.com
      • {BLOCKED}telut.com
      • {BLOCKED}ollar.com
      • {BLOCKED}hymy.com
      • {BLOCKED}e.de
      • {BLOCKED}osadomicilio.es
      • {BLOCKED}rrenteria.com
      • {BLOCKED}.com
      • {BLOCKED}-akermann-architektur-und-planung.ch
      • {BLOCKED}ndbakmetmening.online
      • {BLOCKED}von.gov.uk
      • {BLOCKED}lsa.de
      • {BLOCKED}.team
      • {BLOCKED}ys.de
      • {BLOCKED}llective.com
      • {BLOCKED}ervices.co.uk
      • {BLOCKED}tliv.se
      • {BLOCKED}oneshows.com
      • {BLOCKED}ingstudio.com
      • {BLOCKED}hon.com
      • {BLOCKED}lawngarden.com
      • {BLOCKED}denpadova.it
      • {BLOCKED}rsichert.de
      • {BLOCKED}adolina.bytom.pl
      • {BLOCKED}rk.pl
      • {BLOCKED}present.se
      • {BLOCKED}i.com
      • {BLOCKED}old.de
      • {BLOCKED}tehetkompas.nl
      • {BLOCKED}ediany.com
      • {BLOCKED}lsandboulevards.com
      • {BLOCKED}eymeuli.com
      • {BLOCKED}ap.com
      • {BLOCKED}chardhtx.com
      • {BLOCKED}erwer.com
      • {BLOCKED}te.de
      • {BLOCKED}lyonturin.fr
      • {BLOCKED}.nl
      • {BLOCKED}.town
      • {BLOCKED}lchurch.com
      • {BLOCKED}eetstiger.de
      • {BLOCKED}news.com
      • {BLOCKED}etursystem.dk
      • {BLOCKED}.net
      • {BLOCKED}olanda.com
      • {BLOCKED}la.nl
      • {BLOCKED}yyworkout.com
      • {BLOCKED}holleman.nl
      • {BLOCKED}g.org
      • {BLOCKED}mingelectrical.com
      • {BLOCKED}cialboatbuilding.com
      • {BLOCKED}.com.ar
      • {BLOCKED}ei-fl.de
      • {BLOCKED}n-maquettes.com
      • {BLOCKED}c.ca
      • {BLOCKED}onkatsu.net
      • {BLOCKED}ditservices.nl
      • {BLOCKED}et
      • {BLOCKED}nfamilyfarmblog.wordpress.com
      • {BLOCKED}light.co.uk
      • {BLOCKED}lack.com
      • {BLOCKED}s.com
      • {BLOCKED}x-cr.com
      • {BLOCKED}bms.com
      • {BLOCKED}ite
      • {BLOCKED}onhotels.com
      • {BLOCKED}utio.fi
      • {BLOCKED}grayimages.com
      • {BLOCKED}i.de
      • {BLOCKED}arseguidores.com
      • {BLOCKED}epley.wordpress.com
      • {BLOCKED}ry201.com
      • {BLOCKED}.com
      • {BLOCKED}all.se
      • {BLOCKED}org
      • {BLOCKED}curtainsltd.co.uk
      • {BLOCKED}dermatology.lt
      • {BLOCKED}dvertising.com
      • {BLOCKED}lybluesky.com
      • {BLOCKED}kreader.de
      • {BLOCKED}cientific.com
      • {BLOCKED}sbazaar.com
      • {BLOCKED}ntal.com
      • {BLOCKED}alenhancementcenter.com
      • {BLOCKED}r
      • {BLOCKED}gankunciakrilikbandung.com
      • {BLOCKED}tancywijchen.nl
      • {BLOCKED}ieldoptimaldentalcare.com
      • {BLOCKED}cloud.com
      • {BLOCKED}-foerderdiagnostik.de
      • {BLOCKED}ie
      • {BLOCKED}intoptinyhomes.com
      • {BLOCKED}ionmaison.info
      • {BLOCKED}-swiss.ch
      • {BLOCKED}doareeiro.com
      • {BLOCKED}usel.nl
      • {BLOCKED}aterheaterinstallation.com
      • {BLOCKED}patch.co.uk
      • {BLOCKED}forlease.com
      • {BLOCKED}-zily.eu
      • {BLOCKED}events.com
      • {BLOCKED}rup.com
      • {BLOCKED}on-arte.de
      • {BLOCKED}singout.com
      • {BLOCKED}aileystudio.com
      • {BLOCKED}opticiens.nl
      • {BLOCKED}stcabinets.ca
      • {BLOCKED}es
      • {BLOCKED}eetc.fr
      • {BLOCKED}ing-info.nl
      • {BLOCKED}ca
      • {BLOCKED}rauge-entfernen.de
      • {BLOCKED}nbreezedancetheater.org
      • {BLOCKED}.de
      • {BLOCKED}-kka.no
      • {BLOCKED}collie-nim.nl
      • {BLOCKED}eaymedia.es
      • {BLOCKED}.hu
      • {BLOCKED}te-erler.com
      • {BLOCKED}sapropaneaz.com
      • {BLOCKED}ron.net
      • {BLOCKED}rity.com
      • {BLOCKED}a.lt
      • {BLOCKED}noy.com
      • {BLOCKED}rtualizer.com
      • {BLOCKED}-consulting.at
      • {BLOCKED}tdesdombes.com
      • {BLOCKED}usacademy.com
      • {BLOCKED}rivee.ca
      • {BLOCKED}rraypugh.com
      • {BLOCKED}styk.com
      • {BLOCKED}egsm.net
      • {BLOCKED}.org
      • {BLOCKED}is.com
      • {BLOCKED}oengijon.es
      • {BLOCKED}udte.de
      • {BLOCKED}lorna.org
      • {BLOCKED}grimm.de
      • {BLOCKED}n-nu.nl
      • {BLOCKED}acy.com
      • {BLOCKED}ska.se
      • {BLOCKED}handung.com
      • {BLOCKED}ysolution.com
      • {BLOCKED}beskid.com.ua
      • {BLOCKED}nvestbank.com
      • {BLOCKED}.at
      • {BLOCKED}dogshop.de
      • {BLOCKED}on.de
      • {BLOCKED}nuernberg.de
      • {BLOCKED}rdinaryoutdoors.com
      • {BLOCKED}petlovers.com
      • {BLOCKED}oga.de
      • {BLOCKED}-first.com
      • {BLOCKED}ews.com
      • {BLOCKED}u
      • {BLOCKED}rt-capital.de
      • {BLOCKED}e
      • {BLOCKED}cachorros.com
      • {BLOCKED}ou.at
      • {BLOCKED}yrs.com
      • {BLOCKED}autysalon.com
      • {BLOCKED}mer.at
      • {BLOCKED}s.com
      • {BLOCKED}informatique.fr
      • {BLOCKED}
      • {BLOCKED}arandgrillorlando.com
      • {BLOCKED}chenexpo.jp
      • {BLOCKED}sstoves.com
      • {BLOCKED}cces.com
      • {BLOCKED}.de
      • {BLOCKED}ffeine.com
      • {BLOCKED}r-praezisionsteile.de
      • {BLOCKED}nstallations.co.uk
      • {BLOCKED}rcoiris.com
      • {BLOCKED}lwellbeing.org.uk
      • {BLOCKED}shepherd.co.uk
      • {BLOCKED}ccabe.fun
      • {BLOCKED}um.com
      • {BLOCKED}ethai.co.th
      • {BLOCKED}lls.com
      • {BLOCKED}osser.de
      • {BLOCKED}use.rw
      • {BLOCKED}rtaxi.sk
      • {BLOCKED}telspa.fi
      • {BLOCKED}nami.ru
      • {BLOCKED}notai.it
      • {BLOCKED}rejuveme.com
      • {BLOCKED}ylesnow.site
      • {BLOCKED}illiamsburg.com
      • {BLOCKED}ownpapershow.com
      • {BLOCKED}stest.ru
      • {BLOCKED}taractadenacimiento.com
      • {BLOCKED}mber.aberdeen.sch.uk
      • {BLOCKED}byjax.com
      • {BLOCKED}ang.com
      • {BLOCKED}.nl
      • {BLOCKED}sgebakkramen.nl
      • {BLOCKED}solutindo.com
      • {BLOCKED}hale.com
      • {BLOCKED}yrivercentre.co.uk
      • {BLOCKED}echnology
      • {BLOCKED}en.com
      • {BLOCKED}istik.eu
      • {BLOCKED}ans.com.au
      • {BLOCKED}baugutachterpraxis.de
      • {BLOCKED}ai.fr
      • {BLOCKED}image.com
      • {BLOCKED}ftet-pua.biz
      • {BLOCKED}.tech
      • {BLOCKED}sultsmarketing.com
      • {BLOCKED}arisher.com
      • {BLOCKED}eadvisorsolutions.com
      • {BLOCKED}studios.com
      • {BLOCKED}stribution.co.uk
      • {BLOCKED}rwife.com
      • {BLOCKED}ram.com
      • {BLOCKED}e.com
      • {BLOCKED}scenter.es
      • {BLOCKED}ontage.dk
      • {BLOCKED}ift.eu
      • {BLOCKED}uettes.eu
      • {BLOCKED}ope.com
      • {BLOCKED}rstuuv.de
      • {BLOCKED}marrakesch.de
      • {BLOCKED}.at
      • {BLOCKED}nesthomegoods.com
      • {BLOCKED}ler.se
      • {BLOCKED}rlrecovery.com
      • {BLOCKED}mirezcpa.com
      • {BLOCKED}iends18.de
      • {BLOCKED}entral.at
      • {BLOCKED}uu.ru
      • {BLOCKED}ionbevel.com
      • {BLOCKED}mingstudio.com
      • {BLOCKED}.de
      • {BLOCKED}rkersolution.com
      • {BLOCKED}-fink.de
      • {BLOCKED}ora.dk
      • {BLOCKED}l-kochen.de
      • {BLOCKED}o.com
      • {BLOCKED}lfe-unterricht.com
      • {BLOCKED}-cets.com
      • {BLOCKED}nic.org
      • {BLOCKED}ot.com
      • {BLOCKED}.com
      • {BLOCKED}hd.online
      • {BLOCKED}blum.de
      • {BLOCKED}reducer.com
      • {BLOCKED}isonciliegie.it
      • {BLOCKED}ickcom.wordpress.com
      • {BLOCKED}arketing.pro
      • {BLOCKED}ifpthaiphong.net
      • {BLOCKED}-buerotechnik.at
      • {BLOCKED}estate.com
      • {BLOCKED}cs.com
      • {BLOCKED}2day.de
      • {BLOCKED}-marking.com
      • {BLOCKED}0.com
      • {BLOCKED}inarebuffetcourses.com
      • {BLOCKED}p.co.th
      • {BLOCKED}a.com
      • {BLOCKED}vetal.hr
      • {BLOCKED}c.de
      • {BLOCKED}keslerministries.com
      • {BLOCKED}sack-test.net
      • {BLOCKED}-neuro.com
      • {BLOCKED}aymentservices.com
      • {BLOCKED}-biz.com
      • {BLOCKED}cy.com
      • {BLOCKED}
      • {BLOCKED}h.ch
      • {BLOCKED}entureedge.com
      • {BLOCKED}peptine.ro
      • {BLOCKED}ondron.com
      • {BLOCKED}imariiuniri.ro
      • {BLOCKED}deralautooverseas.com
      • {BLOCKED}anieruchomoscipremium.com
      • {BLOCKED}rklinithome.wordpress.com
      • {BLOCKED}show.com
      • {BLOCKED}d.com
      • {BLOCKED}ter-peloton.com
      • {BLOCKED}itiers.com
      • {BLOCKED}eltips.se
      • {BLOCKED}od.com
      • {BLOCKED}oleoso.de
      • {BLOCKED}residential.com
      • {BLOCKED}laeroclub.co.uk
      • {BLOCKED}zmor.com
      • {BLOCKED}vie21.net
      • {BLOCKED}canho247.com
      • {BLOCKED}fessenjoon.wordpress.com
      • {BLOCKED}s.ch
      • {BLOCKED}formation.fr
      • {BLOCKED}arcas.com
      • {BLOCKED}.com
      • {BLOCKED}alant.com
      • {BLOCKED}andwichmadrid.es
      • {BLOCKED}.de
      • {BLOCKED}.com
      • {BLOCKED}logs.com.ar
      • {BLOCKED}sports.net
      • {BLOCKED}ark.org.uk
      • {BLOCKED}rporttransfers.net
      • {BLOCKED}e
      • {BLOCKED}g.tk
      • {BLOCKED}.nl
      • {BLOCKED}matic.es
      • {BLOCKED}inghiscall.com
      • {BLOCKED}mploymentlawyerblog.com
      • {BLOCKED}-iznanku.com
      • {BLOCKED}.co.uk
      • {BLOCKED}shologram.wordpress.com
      • {BLOCKED}operheet.fi
      • {BLOCKED}diadesign.de
      • {BLOCKED}electrical.co.za
      • {BLOCKED}han.com
      • {BLOCKED}ublique.net
      • {BLOCKED}yartfair.com
      • {BLOCKED}.com
      • {BLOCKED}.carnet.hr
      • {BLOCKED}ealthbasicinfo.com
      • {BLOCKED}.com
      • {BLOCKED}htmeinfonds.at
      • {BLOCKED}inecasinosuk.co.uk
      • {BLOCKED}orcelanatoliquido.online
      • {BLOCKED}oglu.nl
      • {BLOCKED}khalsafoundation.org
      • {BLOCKED}ogs.com
      • {BLOCKED}oysochi.ru
      • {BLOCKED}neaupaysflechois.com
      • {BLOCKED}rttees.com
      • {BLOCKED}olliculoma.info
      • {BLOCKED}nning.com.au
      • {BLOCKED}ctcenter.org
      • {BLOCKED}ansemulhouse.fr
      • {BLOCKED}er5k.com
      • {BLOCKED}ki.nl
      • {BLOCKED}-hrconsulting.ch
      • {BLOCKED}ggivaldelsa.com
      • {BLOCKED}-blumen.de
      • {BLOCKED}rger.at
      • {BLOCKED}dia.dk
      • {BLOCKED}rwelt-muenchen-west.de
      • {BLOCKED}pange.com
      • {BLOCKED}ectstore.com
      • {BLOCKED}mel-rednitzhembach.de
      • {BLOCKED}h
      • {BLOCKED}eansunpoker.com
      • {BLOCKED}massoren.com
      • {BLOCKED}ilig.nl
      • {BLOCKED}practice.com
      • {BLOCKED}navi.com
      • {BLOCKED}.at
      • {BLOCKED}d.fr
      • {BLOCKED}e.com
      • {BLOCKED}012.info
      • {BLOCKED}yforex.com
      • {BLOCKED}oeb.com
      • {BLOCKED}-michael.net
      • {BLOCKED}er.co.uk
      • {BLOCKED}roermond.nl
      • {BLOCKED}esporssi.fi
      • {BLOCKED}teaernoudts.nl
      • {BLOCKED}gchemdesign.com
      • {BLOCKED}materieel.nl
      • {BLOCKED}factory.com
      • {BLOCKED}amper.com
      • {BLOCKED}erestingly.ru
      • {BLOCKED}llen.com
      • {BLOCKED}ver-print.ca
      • {BLOCKED}reprohealthuk.com
      • {BLOCKED}bakery.com
      • {BLOCKED}patel.com
      • {BLOCKED}atcher-apkz.com
      • {BLOCKED}uma.com
      • {BLOCKED}ise-tla.fr
      • {BLOCKED}ealherbal.com
      • {BLOCKED}litationcentersinhouston.net
      • {BLOCKED}gdeadnj.com
      • {BLOCKED}lische-pfarrgemeinde-tuniberg.de
      • {BLOCKED}edie-blomberg.de
      • {BLOCKED}e.net
      • {BLOCKED}zky.at
      • {BLOCKED}host
      • {BLOCKED}footballacademy.com
      • {BLOCKED}.com
      • {BLOCKED}tu.com
      • {BLOCKED}tanacommittee.us
      • {BLOCKED}ng.fr
      • {BLOCKED}n.jp
      • {BLOCKED}.com.au
      • {BLOCKED}ei-deboer.de
      • {BLOCKED}.in
      • {BLOCKED}lamsterdam.com
      • {BLOCKED}.fi
      • {BLOCKED}com
      • {BLOCKED}ivers.wordpress.com
      • {BLOCKED}viasennus.fi
      • {BLOCKED}recircular.org
      • {BLOCKED}terkenya.com
      • {BLOCKED}t.it
      • {BLOCKED}om.pe
      • {BLOCKED}.es
      • {BLOCKED}ndbody.com
      • {BLOCKED}ancesolutionsstrategies.com
      • {BLOCKED}es.com
      • {BLOCKED}-yachting.com
      • {BLOCKED}cademy-iraq.org
      • {BLOCKED}nafoundation.org
      • {BLOCKED}ttmeera.com
      • {BLOCKED}app.com
      • {BLOCKED}landelderlaw.com
      • {BLOCKED}tty.wordpress.com
      • {BLOCKED}th.net.au
      • {BLOCKED}a.fr
      • {BLOCKED}obsnet.com
      • {BLOCKED}gprint.no
      • {BLOCKED}ntrum.com
      • {BLOCKED}bp.com
      • {BLOCKED}rtwarriors.at
      • {BLOCKED}ve.de
      • {BLOCKED}eu.sk
      • {BLOCKED}ra.com
      • {BLOCKED}.com
      • {BLOCKED}lierung-lu.de
      • {BLOCKED}anmedia.org
      • {BLOCKED}ystreetrimming.com
      • {BLOCKED}ne.com
      • {BLOCKED}spgolega.com
      • {BLOCKED}center-sachsen.de
      • {BLOCKED}tv.jp
      • {BLOCKED}dip.com.ar
      • {BLOCKED}techengineering.com
      • {BLOCKED}hof-wegleitner.at
      • {BLOCKED}t.ir
      • {BLOCKED}ikschiet.nl
      • {BLOCKED}.net
      • {BLOCKED}grockcolumbia.com
      • {BLOCKED}ign.com
      • {BLOCKED}in-voyage.net
      • {BLOCKED}u.net
      • {BLOCKED}vanie-ako.sk
      • {BLOCKED}andbeauties.org
      • {BLOCKED}ruck.com
      • {BLOCKED}sandbrgrs.com
      • {BLOCKED}ouseusa.com
      • {BLOCKED}aisei.info
      • {BLOCKED}njurylawfirm.com
      • {BLOCKED}ua
      • {BLOCKED}alter.de
      • {BLOCKED}lamedahr.com
      • {BLOCKED}ndcoaching.nl
      • {BLOCKED}nyenvironmental.com
      • {BLOCKED}nepenn.com
      • {BLOCKED}reetpub.com
      • {BLOCKED}x.nl
      • {BLOCKED}ketlist.com.au
      • {BLOCKED}oul.de
      • {BLOCKED}drelaudit.com
      • {BLOCKED}ningen.de
      • {BLOCKED}ing.nl
      • {BLOCKED}wunder.com
      • {BLOCKED}sdofarrobo.com
      • {BLOCKED}ningsadvokaterne.dk
      • {BLOCKED}deoweb.com
      • {BLOCKED}ler.com
      • {BLOCKED}ign.de
      • {BLOCKED}spiegels.nl
      • {BLOCKED}ldekk.com
      • {BLOCKED}ree.com
      • {BLOCKED}ansktgodis.se
      • {BLOCKED}rands.nl
      • {BLOCKED}iv.net
      • {BLOCKED}formulas.com
      • {BLOCKED}eisser.de
      • {BLOCKED}rvicefabbro.com
      • {BLOCKED}mbeyond50.com
      • {BLOCKED}dscrestview.com
      • {BLOCKED}t-de-roses.com
      • {BLOCKED}eathermnl.com
      • {BLOCKED}dvies.nl
      • {BLOCKED}andyman.com
      • {BLOCKED}ency.com
      • {BLOCKED}ytaanet.fi
      • {BLOCKED}funds.com
      • {BLOCKED}fhorses.com
      • {BLOCKED}ive.com
      • {BLOCKED}gicstatements.com
      • {BLOCKED}rserk.com
      • {BLOCKED}p.com
      • {BLOCKED}ical.biz
      • {BLOCKED}pping.co.uk
      • {BLOCKED}ckstudios.com
      • {BLOCKED}apuertorico.com
      • {BLOCKED}aga.es
      • {BLOCKED}onerpaolo.com
      • {BLOCKED}nterprises.com
      • {BLOCKED}outreach.org
      • {BLOCKED}voiceheard.com
      • {BLOCKED}tedifiori.com
      • {BLOCKED}uthafrica.com
      • {BLOCKED}inmediacompanies.com
      • {BLOCKED}rante.fr
      • {BLOCKED}de
      • {BLOCKED}ground-stories.com
      • {BLOCKED}t.fi
      • {BLOCKED}rbrothers.de
      • {BLOCKED}e
      • {BLOCKED}onstruction.com
      • {BLOCKED}nspiration.com
      • {BLOCKED}.at
      • {BLOCKED}earme.org
      • {BLOCKED}windowco.com
      • {BLOCKED}.com
      • {BLOCKED}hubl.com
      • {BLOCKED}t.com
      • {BLOCKED}tis.de
      • {BLOCKED}dorpskernnoordwijk.nl
      • {BLOCKED}artner.dk
      • {BLOCKED}-chanko.com
      • {BLOCKED}thingasgovernment.com
      • {BLOCKED}er-creteil.com
      • {BLOCKED}rewingcoffee.com
      • {BLOCKED}rlehalle.de
      • {BLOCKED}eskusrok.fi
      • {BLOCKED}esthreecharters.com
      • {BLOCKED}tribution.nl
      • {BLOCKED}erzradio1.site
      • {BLOCKED}t.dk
      • {BLOCKED}sia.com.au
      • {BLOCKED}sresource.org
      • {BLOCKED}g.hr
      • {BLOCKED}rcafe-wuppertal.de
      • {BLOCKED}info
      • {BLOCKED}iness.com
      • {BLOCKED}sreger.com
      • {BLOCKED}necreative.com
      • {BLOCKED}-zhulebino-24.ru
      • {BLOCKED}arma.fr
      • {BLOCKED}le.org
      • {BLOCKED}healthsystem.org
      • {BLOCKED}aavapor.net
      • {BLOCKED}p.com.ng
      • {BLOCKED}ids.com
      • {BLOCKED}e
      • {BLOCKED}a.com
      • {BLOCKED}carnero.com
      • {BLOCKED}ark.ch
      • {BLOCKED}et.dk
      • {BLOCKED}3.de
      • {BLOCKED}fischer.de
      • {BLOCKED}urappliances.com
      • {BLOCKED}lamarketing.com
      • {BLOCKED}citysecrets.com.au
      • {BLOCKED}oorcare.com
      • {BLOCKED}ngavesta.se
      • {BLOCKED}rmier.com
      • {BLOCKED}om.ua
      • {BLOCKED}demy.in
      • {BLOCKED}leta.cat
      • {BLOCKED}t-ideenreich.de
      • {BLOCKED}-referencement-naturel-geneve.net
      • {BLOCKED}w.org.uk
      • {BLOCKED}rveys.com
      • {BLOCKED}p.com
      • {BLOCKED}yacademy.org
      • {BLOCKED}ekiko.online
      • {BLOCKED}juweliere.de
      • {BLOCKED}edumanagement.com
      • {BLOCKED}g.de
      • {BLOCKED}oder.nl
      • {BLOCKED}.ca
      • {BLOCKED}aorindia.com
      • {BLOCKED}ortesycementoshidalgo.es
      • {BLOCKED}werks.com
      • {BLOCKED}4papers.trade
      • {BLOCKED}ldskc.com
      • {BLOCKED}dbeasts.com
      • {BLOCKED}ationanalytics.com
      • {BLOCKED}bergartstudio.gallery
      • {BLOCKED}gyn.net
      • {BLOCKED}med.com
      • {BLOCKED}ator.com
      • {BLOCKED}ingwisdom.com
      • {BLOCKED}ti.com
      • {BLOCKED}ail.com
      • {BLOCKED}.io
      • {BLOCKED}ision.com
      • {BLOCKED}at-asphaltfieber.de
      • {BLOCKED}er-versicherungsvergleich.de
      • {BLOCKED}otion.com
      • {BLOCKED}vents.com
      • {BLOCKED}os-en-alicante.es
      • {BLOCKED}ns.com
      • {BLOCKED}mash.ru
      • {BLOCKED}ezfornes.es
      • {BLOCKED}ngessay.com
      • {BLOCKED}ck.com
      • {BLOCKED}.com
      • {BLOCKED}reations.com
      • {BLOCKED}iongregal.org
      • {BLOCKED}cepacks.com
      • {BLOCKED}luscarpetandfloors.com
      • {BLOCKED}chid.com
      • {BLOCKED}ssthepepper.com
      • {BLOCKED}pesen.dk
      • {BLOCKED}co.com
      • {BLOCKED}uessentielle.com
      • {BLOCKED}ub.org
      • {BLOCKED}aphic-studio.com
      • {BLOCKED}ptervluchtnewyork.nl
      • {BLOCKED}ediet.fun
      • {BLOCKED}gnandbuild.co.uk
      • {BLOCKED}tebrain.com
      • {BLOCKED}atehelp.com
      • {BLOCKED}.org
      • {BLOCKED}jansen.com
      • {BLOCKED}s.com
      • {BLOCKED}.pl
      • {BLOCKED}ve-waves.co.uk
      • {BLOCKED}a.de
      • {BLOCKED}randpalais.com
      • {BLOCKED}dia.nl
      • {BLOCKED}tydowntown.com
      • {BLOCKED}hers.com
      • {BLOCKED}typlus.org
      • {BLOCKED}club-magdeburg.de
      • {BLOCKED}-hospital.de
      • {BLOCKED}oan.org
      • {BLOCKED}ibbie.com
      • {BLOCKED}recorporatelaw.com
      • {BLOCKED}r.co.jp
      • {BLOCKED}gopdie-leverkusen-kwb.de
      • {BLOCKED}ongilmour.co.uk
      • {BLOCKED}pactoutdoors.net
      • {BLOCKED}papercut.com
      • {BLOCKED}labergeggi.it
      • {BLOCKED}ou-coworking.com
      • {BLOCKED}rlin
      • {BLOCKED}chie.com
      • {BLOCKED}wconsultancy.com
      • {BLOCKED}ucmctc-13a1357egba.com
      • {BLOCKED}marysalud.com
      • {BLOCKED}las-und-kunst.de
      • {BLOCKED}vice.org
      • {BLOCKED}iua.com
      • {BLOCKED}ndholic.com
      • {BLOCKED}ccw.com
      • {BLOCKED}ningweek.pl
      • {BLOCKED}atif-lave-linge.fr
      • {BLOCKED}ier.com
      • {BLOCKED}round.org
    • String 1:
      • wp-content
      • static
      • content
      • include
      • uploads
      • news
      • data
      • admin
    • String 2:
      • images
      • pictures
      • image
      • temp
      • tmp
      • graphic
      • assets
      • pics
      • game

ランサムウェアの不正活動

マルウェアは、ファイル名に以下の文字列を含むファイルの暗号化はしません。

  • autorun.inf
  • ntldr
  • bootfont.bin
  • ntuser.ini
  • boot.ini
  • ntuser.dat.log
  • thumbs.db
  • desktop.ini
  • ntuser.dat
  • iconcache.db
  • bootsect.bak

マルウェアは、ファイルパスに以下の文字列を含むファイルの暗号化はしません。

  • google
  • $recycle.bin
  • tor browser
  • application data
  • boot
  • windows.old
  • intel
  • system volume information
  • msocache
  • $windows.~bt
  • programdata
  • program files
  • $windows.~ws
  • appdata
  • perflogs
  • program files (x86)
  • mozilla
  • windows

マルウェアは、暗号化されたファイルのファイル名に以下の拡張子を追加します。

  • .{Random characters}

マルウェアが作成する以下のファイルは、脅迫状です。

  • {Encrypted directory}\{Random characters}-readme.txt

以下のファイル拡張子を持つファイルについては暗号化しません：

  • ani
  • com
  • idx
  • adv
  • prf
  • key
  • ics
  • drv
  • icl
  • cur
  • shs
  • mpa
  • msi
  • lnk
  • bat
  • 386
  • themepack
  • msstyles
  • diagcfg
  • cpl
  • rtp
  • deskthemepack
  • spl
  • ps1
  • diagcab
  • nomedia
  • msc
  • msu
  • wpx
  • icns
  • nls
  • hta
  • ocx
  • ico
  • theme
  • sys
  • mod
  • cab
  • msp
  • scr
  • diagpkg
  • hlp
  • rom
  • ldf
  • dll
  • lock
  • cmd
  • exe
  • bin

注意：

マルウェアは、以下の画像を表示します。

  対応方法

対応検索エンジン: 9.850
初回 VSAPI パターンバージョン 16.132.05
初回 VSAPI パターンリリース日 2020年7月29日
VSAPI OPR パターンバージョン 16.133.00
VSAPI OPR パターンリリース日 2020年7月30日

手順 1

Windows 7、Windows 8、Windows 8.1、および Windows 10 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

このマルウェアもしくはアドウェア等の実行により、手順中に記載されたすべてのファイル、フォルダおよびレジストリキーや値がコンピュータにインストールされるとは限りません。インストールが不完全である場合の他、オペレーティングシステム（OS）の条件によりインストールがされない場合が考えられます。手順中に記載されたファイル／フォルダ／レジストリ情報が確認されない場合、該当の手順の操作は不要ですので、次の手順に進んでください。

手順 3

Windowsをセーフモードで再起動します。

[ 詳細 ]

手順 4

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\{Random characters}.bmp
  • {Encrypted directory}\{Random characters}-readme.txt

手順 5

コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「Ransom.PS1.SODINOKIBI.B」と検出したファイルの検索を実行してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 6

暗号化されたファイルをバックアップから復元します。


ご利用はいかがでしたか？　アンケートにご協力ください