Ransom.PS1.SODINOKIBI.E

This Ransomware drops files as ransom note. It avoids encrypting files with the following file extensions.

Installation

This Ransomware drops the following files:

• %User Temp%\{random characters}.bmp -> used as wallpaper

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{GUID}

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
0Js = {Hex Data}

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
gP0M = {Hex Data}

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
t4bni = {Hex Data}

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
3kVcVE = {Hex Data}

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
XlHEvKMB = {Hex Data}

HKEY_LOCAL_MACHINE\SOFTWARE\BlackLivesMatter
7NGLR8w = {appended extension}

It changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{random characters}.bmp

It sets the system's desktop wallpaper to the following image:

Process Termination

This Ransomware terminates the following services if found on the affected system:

• backup
• memtas
• mepocs
• sophos
• sql
• svc$
• veeam
• vss

It terminates the following processes if found running in the affected system's memory:

• agntsvc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• msaccess
• mspub
• mydesktopqoos
• mydesktopservice
• ocautoupds
• ocomm
• ocssd
• onenote
• oracle
• outlook
• powerpnt
• sql
• sqbcoreservice
• steam
• synctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• xfssvccon

Information Theft

This Ransomware gathers the following data:

• Computer Name
• Computer Locale
• Operating System Name and Version
• Processor Information
• System Architecture
• Username
• Volume Information
• Workgroup

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}rger.at
• {BLOCKED}ska.se
• {BLOCKED}-zily.eu
• {BLOCKED}rvicefabbro.com
• {BLOCKED}mily.construction
• {BLOCKED}tspraktijkhartjegroningen.nl
• {BLOCKED}eesurveys.com
• {BLOCKED}rradler.de
• {BLOCKED}aga.es
• {BLOCKED}ngbonanza.com
• {BLOCKED}ick.com
• {BLOCKED}rhealth.live
• {BLOCKED}oberts.co.nz
• {BLOCKED}e.network
• {BLOCKED}automation.de
• {BLOCKED}ezfornes.es
• {BLOCKED}us.eu
• {BLOCKED}t-de-roses.com
• {BLOCKED}mber.aberdeen.sch.uk
• {BLOCKED}rus-ratgeber.de
• {BLOCKED}r.be
• {BLOCKED}d-felix.co.uk
• {BLOCKED}enreich27.de
• {BLOCKED}-kids.info
• {BLOCKED}med.com
• {BLOCKED}b.de
• {BLOCKED}oul.de
• {BLOCKED}uethi-allart.ch
• {BLOCKED}g.solutionsarchitect.guru
• {BLOCKED}nbeach-realestate.com
• {BLOCKED}t.de
• {BLOCKED}lyonturin.fr
• {BLOCKED}er5k.com
• {BLOCKED}erage.com.au
• {BLOCKED}rante.fr
• {BLOCKED}e.com
• {BLOCKED}rmier.com
• {BLOCKED}en-bauer.at
• {BLOCKED}el-paysage.fr
• {BLOCKED}onk.online
• {BLOCKED}ti.com
• {BLOCKED}cocom.fr
• {BLOCKED}l.org
• {BLOCKED}ram.com
• {BLOCKED}center-sachsen.de
• {BLOCKED}ietdichter.nl
• {BLOCKED}lybluesky.com
• {BLOCKED}ler.com
• {BLOCKED}yggen.se
• {BLOCKED}ground-stories.com
• {BLOCKED}rporttransfers.net
• {BLOCKED}3.de
• {BLOCKED}patch.co.uk
• {BLOCKED}tingsrbija.rs
• {BLOCKED}act.com
• {BLOCKED}acy.com
• {BLOCKED}wconsultancy.com
• {BLOCKED}round.org
• {BLOCKED}cy.com
• {BLOCKED}c.com
• {BLOCKED}u.net
• {BLOCKED}peptine.ro
• {BLOCKED}g.netgateway.eu
• {BLOCKED}show.com
• {BLOCKED}inmediacompanies.com
• {BLOCKED}mash.ru
• {BLOCKED}dbeasts.com
• {BLOCKED}ack.de
• {BLOCKED}e.at
• {BLOCKED}hon.com
• {BLOCKED}ggroup.com
• {BLOCKED}anservicescourses.com
• {BLOCKED}t.ca
• {BLOCKED}reations.com
• {BLOCKED}lnessmimi.com
• {BLOCKED}dias.com
• {BLOCKED}e.de
• {BLOCKED}ne.com
• {BLOCKED}aphic-studio.com
• {BLOCKED}ing.nl
• {BLOCKED}eadvisorsolutions.com
• {BLOCKED}d.com
• {BLOCKED}g.tk
• {BLOCKED}bogatyr.ru
• {BLOCKED}canho247.com
• {BLOCKED}scenter.es
• {BLOCKED}eskusrok.fi
• {BLOCKED}ilig.nl
• {BLOCKED}spgolega.com
• {BLOCKED}ury.com
• {BLOCKED}dorpskernnoordwijk.nl
• {BLOCKED}light.co.uk
• {BLOCKED}iapsicologia.es
• {BLOCKED}arvalhoerodrigues.com.br
• {BLOCKED}asternacademyofprosthodontics.org
• {BLOCKED}s.ch
• {BLOCKED}yrs.com
• {BLOCKED}pactoutdoors.net
• {BLOCKED}ngay.com
• {BLOCKED}ontage.dk
• {BLOCKED}sserie.com
• {BLOCKED}us.com
• {BLOCKED}uthafrica.com
• {BLOCKED}ter.nl
• {BLOCKED}rsichert.de
• {BLOCKED}leta.cat
• {BLOCKED}ttabernacle.com
• {BLOCKED}ecturalfiberglass.org
• {BLOCKED}hesterescorts.co.uk
• {BLOCKED}ark.org.uk
• {BLOCKED}ator.com
• {BLOCKED}rdinaryoutdoors.com
• {BLOCKED}ccw.com
• {BLOCKED}byjax.com
• {BLOCKED}osting.net
• {BLOCKED}p.com
• {BLOCKED}k.de
• {BLOCKED}aymentservices.com
• {BLOCKED}oder.nl
• {BLOCKED}blum.de
• {BLOCKED}ftet-pua.biz
• {BLOCKED}tedace.com
• {BLOCKED}s-gruppe.de
• {BLOCKED}gleitlager.de
• {BLOCKED}gopdie-leverkusen-kwb.de
• {BLOCKED}nova.wordpress.com
• {BLOCKED}b.com
• {BLOCKED}ybrid.com.au
• {BLOCKED}arthstudio.com
• {BLOCKED}marrakesch.de
• {BLOCKED}ps.se
• {BLOCKED}r.town
• {BLOCKED}papercut.com
• {BLOCKED}merawilltravel2017.wordpress.com
• {BLOCKED}ithatgo.com
• {BLOCKED}e.com
• {BLOCKED}achineryauctions.com
• {BLOCKED}-swiss.ch
• {BLOCKED}zmor.com
• {BLOCKED}ldekk.com
• {BLOCKED}-marking.com
• {BLOCKED}hd.online
• {BLOCKED}tauscher-berechnen.de
• {BLOCKED}c.es
• {BLOCKED}illiamsburg.com
• {BLOCKED}leyministries.com
• {BLOCKED}ongilmour.co.uk
• {BLOCKED}a.se
• {BLOCKED}nha.com.vn
• {BLOCKED}b.lt
• {BLOCKED}t.de
• {BLOCKED}forlease.com
• {BLOCKED}sandbrgrs.com
• {BLOCKED}l.com
• {BLOCKED}ch.com
• {BLOCKED}ruck.com
• {BLOCKED}rrenteria.com
• {BLOCKED}uthclothingcompany.com
• {BLOCKED}ision.com
• {BLOCKED}inghiscall.com
• {BLOCKED}rklinithome.wordpress.com
• {BLOCKED}k.info
• {BLOCKED}inghealthbenefits.com
• {BLOCKED}usel.nl
• {BLOCKED}fenutrition.com
• {BLOCKED}s.technology
• {BLOCKED}eyforex.com
• {BLOCKED}tudy.com
• {BLOCKED}-nuernberg.de
• {BLOCKED}lblum.info
• {BLOCKED}orwife.com
• {BLOCKED}et.com
• {BLOCKED}g.de
• {BLOCKED}lyon.com
• {BLOCKED}anieprzedszkolne.pl
• {BLOCKED}matepro.com.au
• {BLOCKED}-wood.com
• {BLOCKED}ybacktolife.com
• {BLOCKED}et.dk
• {BLOCKED}nglebrsen-vergleich-nec.com
• {BLOCKED}oengijon.es
• {BLOCKED}vie21.net
• {BLOCKED}rauge-entfernen.de
• {BLOCKED}t.com
• {BLOCKED}n.com
• {BLOCKED}r.com
• {BLOCKED}ora.dk
• {BLOCKED}tancywijchen.nl
• {BLOCKED}oliveira.com
• {BLOCKED}ointefellowship.church
• {BLOCKED}drelaudit.com
• {BLOCKED}st.dk
• {BLOCKED}-chocolat-noir.com
• {BLOCKED}g.com
• {BLOCKED}cachorros.com
• {BLOCKED}pping.co.uk
• {BLOCKED}ingwisdom.com
• {BLOCKED}t.guru
• {BLOCKED}opticiens.nl
• {BLOCKED}lesspromo.com
• {BLOCKED}o.com.pl
• {BLOCKED}ki.nl
• {BLOCKED}ataamo.fi
• {BLOCKED}erzradio1.site
• {BLOCKED}voiceheard.com
• {BLOCKED}etursystem.dk
• {BLOCKED}ast.se
• {BLOCKED}doareeiro.com
• {BLOCKED}j.org
• {BLOCKED}lhammer.com
• {BLOCKED}ill.guru
• {BLOCKED}ogs.com
• {BLOCKED}baugutachterpraxis.de
• {BLOCKED}erwer.com
• {BLOCKED}d.bc.ca
• {BLOCKED}i.de
• {BLOCKED}utio.fi
• {BLOCKED}says.net
• {BLOCKED}a.es
• {BLOCKED}r.pro
• {BLOCKED}bms.com
• {BLOCKED}a.gr
• {BLOCKED}sgebakkramen.nl
• {BLOCKED}ei-fl.de
• {BLOCKED}t.com
• {BLOCKED}oga.de
• {BLOCKED}luscarpetandfloors.com
• {BLOCKED}coaching.fr
• {BLOCKED}oralmedicinespecialists.com
• {BLOCKED}grimm.de
• {BLOCKED}tsumba.nl
• {BLOCKED}m.nl
• {BLOCKED}inecasinosuk.co.uk
• {BLOCKED}ise-tla.fr
• {BLOCKED}-kanto.com
• {BLOCKED}sterputssollentuna-39b.se
• {BLOCKED}modsapks.com
• {BLOCKED}olbh.com.br
• {BLOCKED}interieurprojecten.nl
• {BLOCKED}-blumen.de
• {BLOCKED}oysochi.ru
• {BLOCKED}rlrecovery.com
• {BLOCKED}en.at
• {BLOCKED}skibbie.com
• {BLOCKED}agen.com
• {BLOCKED}videoweb.com
• {BLOCKED}ineetc.fr
• {BLOCKED}inlchurch.com
• {BLOCKED}achcenter.de
• {BLOCKED}rg-autoimport.nl
• {BLOCKED}owroermond.nl
• {BLOCKED}chelectrical.co.za
• {BLOCKED}dograsoweb.com
• {BLOCKED}latebrain.com
• {BLOCKED}ma-shihou.com
• {BLOCKED}eholanda.com
• {BLOCKED}eimer.at
• {BLOCKED}ulator-oszczednosci.pl
• {BLOCKED}erwis.pl
• {BLOCKED}atesthreecharters.com
• {BLOCKED}rgysolution.com
• {BLOCKED}ebarandgrillorlando.com
• {BLOCKED}chhubl.com
• {BLOCKED}elbroch.com
• {BLOCKED}eadache.com
• {BLOCKED}power.at
• {BLOCKED}poitiers.com
• {BLOCKED}.at
• {BLOCKED}ekturbuero-wagner.net
• {BLOCKED}grayimages.com
• {BLOCKED}ark.ch
• {BLOCKED}racoles.com
• {BLOCKED}ad-direkt.de
• {BLOCKED}asterimages.org
• {BLOCKED}use.net
• {BLOCKED}chooldezonnewijzer.nl
• {BLOCKED}ndbakmetmening.online
• {BLOCKED}t.com
• {BLOCKED}rserk.com
• {BLOCKED}ink.net
• {BLOCKED}carnero.com
• {BLOCKED}psy.fr
• {BLOCKED}fessenjoon.wordpress.com
• {BLOCKED}-buerotechnik.at
• {BLOCKED}nstallations.co.uk
• {BLOCKED}campingdoonbeg.com
• {BLOCKED}dgemuseumbd.com
• {BLOCKED}ns.com
• {BLOCKED}a.de
• {BLOCKED}healthsystem.org
• {BLOCKED}ei-deboer.de
• {BLOCKED}telefon.hr
• {BLOCKED}use.rw
• {BLOCKED}in.com
• {BLOCKED}-home.com
• {BLOCKED}empore.net
• {BLOCKED}sresource.org
• {BLOCKED}er.com
• {BLOCKED}ndbody.com
• {BLOCKED}gratuitosnainternet.com
• {BLOCKED}gringo.com
• {BLOCKED}k.ru
• {BLOCKED}rtualizer.com
• {BLOCKED}lorna.org
• {BLOCKED}hymy.com
• {BLOCKED}ntrum.com
• {BLOCKED}.com
• {BLOCKED}lawngarden.com
• {BLOCKED}lose-webcams.com
• {BLOCKED}vanie-ako.sk
• {BLOCKED}ursery.com
• {BLOCKED}ingsulweb.com
• {BLOCKED}.com
• {BLOCKED}on.com
• {BLOCKED}ikschiet.nl
• {BLOCKED}ter-peloton.com
• {BLOCKED}epley.wordpress.com
• {BLOCKED}marcomdotcom.wordpress.com
• {BLOCKED}ive.com
• {BLOCKED}.ua
• {BLOCKED}eltips.se
• {BLOCKED}.com.au
• {BLOCKED}2day.de
• {BLOCKED}and24.de
• {BLOCKED}gankunciakrilikbandung.com
• {BLOCKED}sia.com.au
• {BLOCKED}ag.com
• {BLOCKED}al.ru
• {BLOCKED}thlaw.com
• {BLOCKED}cay.com.ar
• {BLOCKED}.gr
• {BLOCKED}ullah.com
• {BLOCKED}edumanagement.com
• {BLOCKED}d.de
• {BLOCKED}denbollnas.se
• {BLOCKED}irche-gera.de
• {BLOCKED}r-factory.co.jp
• {BLOCKED}footballacademy.com
• {BLOCKED}th.net.au
• {BLOCKED}loanslenders.com
• {BLOCKED}gdeadnj.com
• {BLOCKED}wunder.com
• {BLOCKED}g.de
• {BLOCKED}com.sg
• {BLOCKED}gyn.net
• {BLOCKED}materieel.nl
• {BLOCKED}rbau-ziegler.de
• {BLOCKED}egsm.net
• {BLOCKED}.ru
• {BLOCKED}fr
• {BLOCKED}ncy.com
• {BLOCKED}iapmg.com
• {BLOCKED}operheet.fi
• {BLOCKED}icapublica.es
• {BLOCKED}ckstudios.com
• {BLOCKED}ptervluchtnewyork.nl
• {BLOCKED}ighscoutgroup.org
• {BLOCKED}la-dr-sturm.at
• {BLOCKED}onhotels.com
• {BLOCKED}imariiuniri.ro
• {BLOCKED}formation.fr
• {BLOCKED}yrivercentre.co.uk
• {BLOCKED}amber.com
• {BLOCKED}.nl
• {BLOCKED}uu.ru
• {BLOCKED}ifpthaiphong.net
• {BLOCKED}osaccidentetraficosevilla.es
• {BLOCKED}landelderlaw.com
• {BLOCKED}mirezcpa.com
• {BLOCKED}do.nl
• {BLOCKED}.fi
• {BLOCKED}opioidworkgroup.org
• {BLOCKED}ourconstruction.com
• {BLOCKED}eisser.de
• {BLOCKED}las-und-kunst.de
• {BLOCKED}bergartstudio.gallery
• {BLOCKED}i
• {BLOCKED}urappliances.com
• {BLOCKED}arketing.pro
• {BLOCKED}chwartz.wordpress.com
• {BLOCKED}lls.com
• {BLOCKED}reetpub.com
• {BLOCKED}119.com
• {BLOCKED}ansktgodis.se
• {BLOCKED}amezone.com
• {BLOCKED}aking.nl
• {BLOCKED}.fi
• {BLOCKED}x-cr.com
• {BLOCKED}dentists.com
• {BLOCKED}.at
• {BLOCKED}l-kochen.de
• {BLOCKED}ver-print.ca
• {BLOCKED}nl
• {BLOCKED}aorindia.com
• {BLOCKED}e.com
• {BLOCKED}nline.com
• {BLOCKED}ate.dk
• {BLOCKED}orativeclassroom.org
• {BLOCKED}.org
• {BLOCKED}zky.at
• {BLOCKED}te-erler.com
• {BLOCKED}-cosmetics.at
• {BLOCKED}lrapids.com
• {BLOCKED}arcas.com
• {BLOCKED}ekiko.online
• {BLOCKED}irc.net
• {BLOCKED}kwork.pl
• {BLOCKED}tberedare.se
• {BLOCKED}udte.de
• {BLOCKED}onstruction.com
• {BLOCKED}marysalud.com
• {BLOCKED}.com
• {BLOCKED}shepherd.co.uk
• {BLOCKED}kchurch.org
• {BLOCKED}artner.dk
• {BLOCKED}em.net
• {BLOCKED}oeb.com
• {BLOCKED}aterheaterinstallation.com
• {BLOCKED}firm.com
• {BLOCKED}lds.org
• {BLOCKED}ot.com
• {BLOCKED}te.de
• {BLOCKED}lsandboulevards.com
• {BLOCKED}net
• {BLOCKED}holleman.nl
• {BLOCKED}info.pl
• {BLOCKED}er-versicherungsvergleich.de
• {BLOCKED}acioesportivapolitg.cat
• {BLOCKED}stest.ru
• {BLOCKED}rie.com
• {BLOCKED}laeroclub.co.uk
• {BLOCKED}solutindo.com
• {BLOCKED}cht.de
• {BLOCKED}sapropaneaz.com
• {BLOCKED}ndholic.com
• {BLOCKED}.fr
• {BLOCKED}4papers.trade
• {BLOCKED}mingstudio.com
• {BLOCKED}ttepoudroux-photographie.fr
• {BLOCKED}.com
• {BLOCKED}oolfun.net
• {BLOCKED}.team
• {BLOCKED}.com
• {BLOCKED}re.com
• {BLOCKED}khalsafoundation.org
• {BLOCKED}vieira.com
• {BLOCKED}ptfordbuyrite.com
• {BLOCKED}org
• {BLOCKED}tis.de
• {BLOCKED}luku.com
• {BLOCKED}com
• {BLOCKED}pepper.gives
• {BLOCKED}castings.co.uk
• {BLOCKED}hate.org
• {BLOCKED}atives.co
• {BLOCKED}en.de
• {BLOCKED}reprohealthuk.com
• {BLOCKED}ri-pizzeria.de
• {BLOCKED}e
• {BLOCKED}diadesign.de
• {BLOCKED}pasch.me
• {BLOCKED}info
• {BLOCKED}.com
• {BLOCKED}s.com
• {BLOCKED}n.jp
• {BLOCKED}ylesnow.site
• {BLOCKED}pecialisten.se
• {BLOCKED}nstela.com
• {BLOCKED}grasa.net
• {BLOCKED}cademy-iraq.org
• {BLOCKED}viasennus.fi
• {BLOCKED}graphic.com
• {BLOCKED}taforum.com
• {BLOCKED}wealth.com
• {BLOCKED}beskid.com.ua
• {BLOCKED}ollmann.de
• {BLOCKED}arma.fr
• {BLOCKED}celiptv.com
• {BLOCKED}demy.in
• {BLOCKED}matic.es
• {BLOCKED}lan.info
• {BLOCKED}singout.com
• {BLOCKED}eed.com
• {BLOCKED}re.de
• {BLOCKED}sbazaar.com
• {BLOCKED}rkersolution.com
• {BLOCKED}ccabe.fun
• {BLOCKED}ise.de
• {BLOCKED}informatique.fr
• {BLOCKED}cloud.com
• {BLOCKED}loogia.ee
• {BLOCKED}oan.org
• {BLOCKED}dia.dk
• {BLOCKED}mebel63.ru
• {BLOCKED}lobalduz.es
• {BLOCKED}rejuveme.com
• {BLOCKED}inarebuffetcourses.com
• {BLOCKED}shologram.wordpress.com
• {BLOCKED}thingasgovernment.com
• {BLOCKED}telut.com
• {BLOCKED}-opera.de
• {BLOCKED}-hospital.de
• {BLOCKED}roresult.no
• {BLOCKED}erandersonwriter.com
• {BLOCKED}ical.biz
• {BLOCKED}netunnel.com
• {BLOCKED}cientific.com
• {BLOCKED}onkatsu.net
• {BLOCKED}ang.com
• {BLOCKED}hof-wegleitner.at
• {BLOCKED}.com
• {BLOCKED}c.de
• {BLOCKED}co.com
• {BLOCKED}mark.dk
• {BLOCKED}ru
• {BLOCKED}erg.fi
• {BLOCKED}taractadenacimiento.com
• {BLOCKED}thuset.dk
• {BLOCKED}adband.com
• {BLOCKED}singbyjessica.com
• {BLOCKED}osadomicilio.es
• {BLOCKED}.de
• {BLOCKED}-yachting.com
• {BLOCKED}-zhulebino-24.ru
• {BLOCKED}layertest.net
• {BLOCKED}t.it
• {BLOCKED}logs.com.ar
• {BLOCKED}pesen.dk
• {BLOCKED}nafoundation.org
• {BLOCKED}ansemulhouse.fr
• {BLOCKED}.net
• {BLOCKED}lack.com
• {BLOCKED}rttees.com
• {BLOCKED}om.ua
• {BLOCKED}esporssi.fi
• {BLOCKED}stcabinets.ca
• {BLOCKED}012.info
• {BLOCKED}tribution.nl
• {BLOCKED}e.org.gt
• {BLOCKED}dsspar.se
• {BLOCKED}ney-cox.net
• {BLOCKED}iousfestival.co.uk
• {BLOCKED}yfreightservices.com.au
• {BLOCKED}.com
• {BLOCKED}SellsHomes.com
• {BLOCKED}-biz.com
• {BLOCKED}eansunpoker.com
• {BLOCKED}ta.com
• {BLOCKED}n.ag
• {BLOCKED}nning.com.au
• {BLOCKED}terkenya.com
• {BLOCKED}erweldingllc.com
• {BLOCKED}eaymedia.es
• {BLOCKED}rcafe-wuppertal.de
• {BLOCKED}formulas.com
• {BLOCKED}mel-rednitzhembach.de
• {BLOCKED}h
• {BLOCKED}tspraktijkheesch.nl
• {BLOCKED}entmd.org
• {BLOCKED}patel.com
• {BLOCKED}d.com
• {BLOCKED}nesouthasc.com
• {BLOCKED}lovakia.sk
• {BLOCKED}ni.com
• {BLOCKED}chid.com
• {BLOCKED}ron.net
• {BLOCKED}.de
• {BLOCKED}bf.com
• {BLOCKED}e.no
• {BLOCKED}att.no
• {BLOCKED}studio.com
• {BLOCKED}edges.com
• {BLOCKED}aeschbachorg.wordpress.com
• {BLOCKED}.site
• {BLOCKED}t-ideenreich.de
• {BLOCKED}aavapor.net
• {BLOCKED}den.com
• {BLOCKED}fenutrition.com
• {BLOCKED}t.ir
• {BLOCKED}telspa.fi
• {BLOCKED}.io
• {BLOCKED}thebrand.com
• {BLOCKED}-foerderdiagnostik.de
• {BLOCKED}ypartners.nl
• {BLOCKED}vice.org
• {BLOCKED}um.com
• {BLOCKED}massoren.com
• {BLOCKED}labergeggi.it
• {BLOCKED}s.com
• {BLOCKED}rtaxi.sk
• {BLOCKED}ediastrategies.com
• {BLOCKED}cs.com
• {BLOCKED}ids.com
• {BLOCKED}sobancario.net
• {BLOCKED}studios.com
• {BLOCKED}ionbevel.com
• {BLOCKED}tesdemean.be
• {BLOCKED}yartfair.com
• {BLOCKED}arseguidores.com
• {BLOCKED}visions.com
• {BLOCKED}kfoundation.net
• {BLOCKED}andyman.com
• {BLOCKED}err.co.uk
• {BLOCKED}bolanet.info
• {BLOCKED}holleman.nl
• {BLOCKED}tytenfold.com
• {BLOCKED}olen.co.uk
• {BLOCKED}lbridgeadvisors.com
• {BLOCKED}r.co.jp
• {BLOCKED}news.com
• {BLOCKED}state-experts.com
• {BLOCKED}count.at
• {BLOCKED}at.com
• {BLOCKED}ub.org
• {BLOCKED}outreach.org
• {BLOCKED}e.org
• {BLOCKED}oorcare.com
• {BLOCKED}hale.com
• {BLOCKED}es.com
• {BLOCKED}biester.de
• {BLOCKED}neider.info
• {BLOCKED}p.co.th
• {BLOCKED}idedvisit.com
• {BLOCKED}nfamilyfarmblog.wordpress.com
• {BLOCKED}p.com.ng
• {BLOCKED}osanitario.biz
• {BLOCKED}chance.se
• {BLOCKED}njurylawfirm.com
• {BLOCKED}dolls.com
• {BLOCKED}ndcoaching.nl
• {BLOCKED}-chanko.com
• {BLOCKED}-delom.ru
• {BLOCKED}ca
• {BLOCKED}atehelp.com
• {BLOCKED}.hn
• {BLOCKED}oard.info
• {BLOCKED}chise.com
• {BLOCKED}ct.co.uk
• {BLOCKED}mingelectrical.com
• {BLOCKED}a.com
• {BLOCKED}nightdc.com
• {BLOCKED}ign.de
• {BLOCKED}nfo
• {BLOCKED}ay.com
• {BLOCKED}romelabs.com
• {BLOCKED}ews.com
• {BLOCKED}com
• {BLOCKED}-fink.de
• {BLOCKED}ryogacharlotte.com
• {BLOCKED}chi.ru
• {BLOCKED}irius.de
• {BLOCKED}-lecompte-rouen.fr
• {BLOCKED}nyenvironmental.com
• {BLOCKED}mbeyond50.com
• {BLOCKED}ng.fr
• {BLOCKED}nyon.com
• {BLOCKED}fischer.de
• {BLOCKED}ionmaison.info
• {BLOCKED}o.in
• {BLOCKED}u
• {BLOCKED}old.de
• {BLOCKED}com
• {BLOCKED}ndoc.com
• {BLOCKED}
• {BLOCKED}s.org
• {BLOCKED}alenhancementcenter.com
• {BLOCKED}utaylor.com
• {BLOCKED}olliculoma.info
• {BLOCKED}cepacks.com
• {BLOCKED}juweliere.de
• {BLOCKED}ditioning-waalwijk.nl
• {BLOCKED}ieperry.com
• {BLOCKED}.com
• {BLOCKED}club-magdeburg.de
• {BLOCKED}ekupper.com
• {BLOCKED}.org
• {BLOCKED}2-aid-u.com
• {BLOCKED}eopleplaces.com
• {BLOCKED}orcelanatoliquido.online
• {BLOCKED}iminaltribe.wordpress.com
• {BLOCKED}garage.pl
• {BLOCKED}main-trader.com
• {BLOCKED}ethai.co.th
• {BLOCKED}p.org
• {BLOCKED}o.biz
• {BLOCKED}de
• {BLOCKED}vicino.com
• {BLOCKED}s.com
• {BLOCKED}.nl
• {BLOCKED}uessentielle.com
• {BLOCKED}iongregal.org
• {BLOCKED}es
• {BLOCKED}ortesycementoshidalgo.es
• {BLOCKED}edie-blomberg.de
• {BLOCKED}.de
• {BLOCKED}.nl
• {BLOCKED}maketingstrategies.com
• {BLOCKED}na.com
• {BLOCKED}immobilien.de
• {BLOCKED}handung.com
• {BLOCKED}aileystudio.com
• {BLOCKED}thelender.com
• {BLOCKED}ve.de
• {BLOCKED}ign.com
• {BLOCKED}htmeinfonds.at
• {BLOCKED}ningweek.pl
• {BLOCKED}com
• {BLOCKED}pacios.com
• {BLOCKED}app.com
• {BLOCKED}.net
• {BLOCKED}e
• {BLOCKED}erestingly.ru
• {BLOCKED}ier.com
• {BLOCKED}reehouse.net
• {BLOCKED}rt-capital.de
• {BLOCKED}er.com
• {BLOCKED}entral.at
• {BLOCKED}la.nl
• {BLOCKED}-handles.com
• {BLOCKED}ergeyeclinic.com.au
• {BLOCKED}ownideamill.wordpress.com
• {BLOCKED}ar.co.uk
• {BLOCKED}c.com
• {BLOCKED}werks.com
• {BLOCKED}es
• {BLOCKED}ns.net
• {BLOCKED}notai.it
• {BLOCKED}grockcolumbia.com
• {BLOCKED}eetstiger.de
• {BLOCKED}horst.de
• {BLOCKED}arisher.com
• {BLOCKED}ctcenter.org
• {BLOCKED}ngiteexperience.com.au
• {BLOCKED}ivers.wordpress.com
• {BLOCKED}voor-baby.nl
• {BLOCKED}f-mobayl.ru
• {BLOCKED}atif-lave-linge.fr
• {BLOCKED}.cn
• {BLOCKED}ia.vn
• {BLOCKED}randpalais.com
• {BLOCKED}obsnet.com
• {BLOCKED}-a-service.com
• {BLOCKED}0.com
• {BLOCKED}get.com
• {BLOCKED}ningsadvokaterne.dk
• {BLOCKED}ir.com
• {BLOCKED}citysecrets.com.au
• {BLOCKED}management.com
• {BLOCKED}x.nl
• {BLOCKED}amper.com
• {BLOCKED}stions.org
• {BLOCKED}uchmassage.com
• {BLOCKED}montagenijmegen.nl
• {BLOCKED}nami.ru
• {BLOCKED}feststaefa.ch
• {BLOCKED}bp.com
• {BLOCKED}ngminds.wordpress.com
• {BLOCKED}sasdigest.com
• {BLOCKED}ja.com
• {BLOCKED}chenexpo.jp
• {BLOCKED}ditservices.nl
• {BLOCKED}ojekt.com
• {BLOCKED}iv-industry.fr
• {BLOCKED}neaupaysflechois.com
• {BLOCKED}iness.com
• {BLOCKED}dvies.nl
• {BLOCKED}atcher-apkz.com
• {BLOCKED}sack-test.net
• {BLOCKED}mung-bua.online
• {BLOCKED}eathermnl.com
• {BLOCKED}ift.eu
• {BLOCKED}unnan.se
• {BLOCKED}hule-kieber.de
• {BLOCKED}ollar.com
• {BLOCKED}kellari.fi
• {BLOCKED}an.com
• {BLOCKED}dia.nl
• {BLOCKED}yacademy.org
• {BLOCKED}homedogrescue.dog
• {BLOCKED}nspiration.com
• {BLOCKED}ngharnosand.se
• {BLOCKED}theloveofyou.com
• {BLOCKED}ystreetrimming.com
• {BLOCKED}iv.net
• {BLOCKED}lsa.de
• {BLOCKED}store.com
• {BLOCKED}lsmeriglioracing.com
• {BLOCKED}trobos.com
• {BLOCKED}ofessional.ru
• {BLOCKED}lfe-unterricht.com
• {BLOCKED}typlus.org
• {BLOCKED}ose.com
• {BLOCKED}outique247.com
• {BLOCKED}rend.pl
• {BLOCKED}szervizbudapest.hu
• {BLOCKED}alforce.net
• {BLOCKED}gehousesalonvt.com
• {BLOCKED}-lemm.de
• {BLOCKED}sultsmarketing.com
• {BLOCKED}residential.com
• {BLOCKED}ondron.com
• {BLOCKED}collie-nim.nl
• {BLOCKED}ggivaldelsa.com
• {BLOCKED}ris.com
• {BLOCKED}naclubedeportugal.com
• {BLOCKED}ketlist.com.au
• {BLOCKED}g.com
• {BLOCKED}rrior.app
• {BLOCKED}istik.eu
• {BLOCKED}o.com
• {BLOCKED}chardhtx.com
• {BLOCKED}.at
• {BLOCKED}jack-llc.com
• {BLOCKED}ffeine.com
• {BLOCKED}s.ch
• {BLOCKED}ational-sound-awards.com
• {BLOCKED}ter.company
• {BLOCKED}oldriving.com
• {BLOCKED}.hu
• {BLOCKED}rlin
• {BLOCKED}a.com
• {BLOCKED}lt
• {BLOCKED}os-en-alicante.es
• {BLOCKED}cces.com
• {BLOCKED}-consulting.at
• {BLOCKED}zmann.com
• {BLOCKED}ytaanet.fi
• {BLOCKED}.carnet.hr
• {BLOCKED}rbrothers.de
• {BLOCKED}all.se
• {BLOCKED}ealherbal.com
• {BLOCKED}clubetten.nl
• {BLOCKED}oneshows.com
• {BLOCKED}events.com
• {BLOCKED}i.net
• {BLOCKED}ediany.com
• {BLOCKED}ttmeera.com
• {BLOCKED}oglu.nl
• {BLOCKED}com
• {BLOCKED}itte.co.at
• {BLOCKED}techengineering.com
• {BLOCKED}rtriebsforschung.de
• {BLOCKED}-iznanku.com
• {BLOCKED}tdesdombes.com
• {BLOCKED}.com.ar
• {BLOCKED}-referencement-naturel-geneve.net
• {BLOCKED}een-fishing.com
• {BLOCKED}ublique.net
• {BLOCKED}gnandbuild.co.uk
• {BLOCKED}vetal.hr
• {BLOCKED}hwords.net
• {BLOCKED}ownpapershow.com
• {BLOCKED}owers.ru
• {BLOCKED}our-life.jp
• {BLOCKED}.co
• {BLOCKED}ondition.com
• {BLOCKED}roup.com.au
• {BLOCKED}ealthbasicinfo.com
• {BLOCKED}von.gov.uk
• {BLOCKED}at-asphaltfieber.de
• {BLOCKED}boulga.net
• {BLOCKED}iveairllc.com
• {BLOCKED}kraine.com.ua
• {BLOCKED}ua
• {BLOCKED}.de
• {BLOCKED}otion.com
• {BLOCKED}octor.org
• {BLOCKED}teaernoudts.nl
• {BLOCKED}er.co.uk
• {BLOCKED}host
• {BLOCKED}de
• {BLOCKED}rstuuv.de
• {BLOCKED}alant.com
• {BLOCKED}reamingvfcomplet.be
• {BLOCKED}loud.hk
• {BLOCKED}.in
• {BLOCKED}deralautooverseas.com
• {BLOCKED}noway.com
• {BLOCKED}e.net
• {BLOCKED}n-nu.nl
• {BLOCKED}-first.com
• {BLOCKED}-trails.com
• {BLOCKED}usacademy.com
• {BLOCKED}a.lt
• {BLOCKED}noy.com
• {BLOCKED}ardechina.info
• {BLOCKED}mtn.com
• {BLOCKED}odea.com
• {BLOCKED}ms.london
• {BLOCKED}.com
• {BLOCKED}rtles.com
• {BLOCKED}rraypugh.com
• {BLOCKED}stilte.nl
• {BLOCKED}rbosa.com
• {BLOCKED}pange.com
• {BLOCKED}ive.de
• {BLOCKED}upro.com
• {BLOCKED}tyfmm.com
• {BLOCKED}tydowntown.com
• {BLOCKED}od.com
• {BLOCKED}ickcom.wordpress.com
• {BLOCKED}onemedia.com
• {BLOCKED}stinglab.com
• {BLOCKED}rity.com
• {BLOCKED}petlovers.com
• {BLOCKED}ys.de
• {BLOCKED}ap.com
• {BLOCKED}tty.wordpress.com
• {BLOCKED}tlet.com
• {BLOCKED}reetauto.net
• {BLOCKED}in-voyage.net
• {BLOCKED}illedentistry.com
• {BLOCKED}c.co
• {BLOCKED}.pl
• {BLOCKED}forall.org
• {BLOCKED}gicstatements.com
• {BLOCKED}tu.com
• {BLOCKED}.com
• {BLOCKED}tore.com
• {BLOCKED}omsportfondsen.nl
• {BLOCKED}nesthomegoods.com
• {BLOCKED}gsunderlebnis.haus
• {BLOCKED}blessedbykeepingitreal.com
• {BLOCKED}.com
• {BLOCKED}isonciliegie.it
• {BLOCKED}iua.com
• {BLOCKED}ai.fr
• {BLOCKED}foodsgroup.com
• {BLOCKED}nters-in-europe.com
• {BLOCKED}-kka.no
• {BLOCKED}xa.cat
• {BLOCKED}ck.com
• {BLOCKED}is.com
• {BLOCKED}howard.com
• {BLOCKED}dip.com.ar
• {BLOCKED}cel.com
• {BLOCKED}sort.com
• {BLOCKED}cinnovations.com
• {BLOCKED}ationclients.fr
• {BLOCKED}erein-tambach.de
• {BLOCKED}han.com
• {BLOCKED}cs.com
• {BLOCKED}fr
• {BLOCKED}nvestbank.com
• {BLOCKED}chie.com
• {BLOCKED}on.de
• {BLOCKED}.com
• {BLOCKED}org.au
• {BLOCKED}practice.com
• {BLOCKED}ratica.com
• {BLOCKED}intoptinyhomes.com
• {BLOCKED}hawessels.com
• {BLOCKED}grafica.es
• {BLOCKED}whitten.site
• {BLOCKED}keslerministries.com
• {BLOCKED}adolina.bytom.pl
• {BLOCKED}y.com.hk
• {BLOCKED}nternet.it
• {BLOCKED}sports.net
• {BLOCKED}er-creteil.com
• {BLOCKED}tv.jp
• {BLOCKED}auretra.es
• {BLOCKED}eu.sk
• {BLOCKED}-michael.net
• {BLOCKED}ningen.de
• {BLOCKED}meworkhelp.com
• {BLOCKED}recision.co.uk
• {BLOCKED}cloud.com
• {BLOCKED}ectstore.com
• {BLOCKED}rgamila.com
• {BLOCKED}s.group
• {BLOCKED}ingstudio.com
• {BLOCKED}g.org
• {BLOCKED}horst.de
• {BLOCKED}
• {BLOCKED}ezingmachines.com
• {BLOCKED}alents.com
• {BLOCKED}.net
• {BLOCKED}rantesszimmer.de
• {BLOCKED}inangberdaya.com
• {BLOCKED}entureedge.com
• {BLOCKED}rtwarriors.at
• {BLOCKED}stribution.co.uk
• {BLOCKED}ws.jp
• {BLOCKED}spiegels.nl
• {BLOCKED}lamsterdam.com
• {BLOCKED}de
• {BLOCKED}.com
• {BLOCKED}t.fi
• {BLOCKED}.at
• {BLOCKED}bakery.com
• {BLOCKED}-neuro.com
• {BLOCKED}ve-waves.co.uk
• {BLOCKED}avid.com
• {BLOCKED}ing.nl
• {BLOCKED}on-arte.de
• {BLOCKED}a.fr
• {BLOCKED}et
• {BLOCKED}efritid.dk
• {BLOCKED}rveys.com
• {BLOCKED}ldskc.com
• {BLOCKED}ope.com
• {BLOCKED}ctiv-shop.ru
• {BLOCKED}factory.com
• {BLOCKED}gprint.no
• {BLOCKED}eymeuli.com
• {BLOCKED}r-praezisionsteile.de
• {BLOCKED}eting.co.uk
• {BLOCKED}.jp
• {BLOCKED}.de
• {BLOCKED}aybeach.com
• {BLOCKED}ans.com.au
• {BLOCKED}o.pl
• {BLOCKED}rswithlena.wordpress.com
• {BLOCKED}ktro.nl
• {BLOCKED}idascostablanca.es
• {BLOCKED}evue.fr
• {BLOCKED}dscrestview.com
• {BLOCKED}kustomz.com
• {BLOCKED}.es
• {BLOCKED}nsedwards.co.uk
• {BLOCKED}teweddingkansas.com
• {BLOCKED}rlehalle.de
• {BLOCKED}navi.com
• {BLOCKED}andbeauties.org
• {BLOCKED}ihreat.fi
• {BLOCKED}anieruchomoscipremium.com
• {BLOCKED}.com.au
• {BLOCKED}marketing.com
• {BLOCKED}funds.com
• {BLOCKED}ign.com
• {BLOCKED}anmedia.org
• {BLOCKED}ado.de
• {BLOCKED}ngavesta.se
• {BLOCKED}le.org
• {BLOCKED}cklink.com
• {BLOCKED}-undwieweiter.de
• {BLOCKED}park40.com
• {BLOCKED}nfo.tr
• {BLOCKED}onerpaolo.com
• {BLOCKED}h.ch
• {BLOCKED}hut.com
• {BLOCKED}-cets.com
• {BLOCKED}uma.com
• {BLOCKED}litationcentersinhouston.net
• {BLOCKED}s
• {BLOCKED}kowalsky.com
• {BLOCKED}odestates.org
• {BLOCKED}-machine.com
• {BLOCKED}ucmctc-13a1357egba.com
• {BLOCKED}wityu.fund
• {BLOCKED}lamedahr.com
• {BLOCKED}lwellbeing.org.uk
• {BLOCKED}holleman.nl
• {BLOCKED}ou.at
• {BLOCKED}rcoiris.com
• {BLOCKED}pedebroca.com
• {BLOCKED}e
• {BLOCKED}.de
• {BLOCKED}rivee.ca
• {BLOCKED}parbariatrics.com
• {BLOCKED}p.com
• {BLOCKED}-hrconsulting.ch
• {BLOCKED}za.com
• {BLOCKED}fhorses.com
• {BLOCKED}tein-hotte.de
• {BLOCKED}nd-sloboda.com
• {BLOCKED}anson.com
• {BLOCKED}erpd.com
• {BLOCKED}ion.com
• {BLOCKED}ency.com
• {BLOCKED}rup.com
• {BLOCKED}-management-plus.de
• {BLOCKED}.tech
• {BLOCKED}.site
• {BLOCKED}present.se
• {BLOCKED}herefordshire-pc.gov.uk
• {BLOCKED}jos.lt
• {BLOCKED}icmusicfest.com
• {BLOCKED}vents.com
• {BLOCKED}troy72.com
• {BLOCKED}oundation.org
• {BLOCKED}eed.com
• {BLOCKED}llective.com
• {BLOCKED}d.fr
• {BLOCKED}ntal.com
• {BLOCKED}autysalon.com
• {BLOCKED}cialboatbuilding.com
• {BLOCKED}ny-dywan24.pl
• {BLOCKED}ntofue.it
• {BLOCKED}ic-technologies.com
• {BLOCKED}rvices.de
• {BLOCKED}online.com
• {BLOCKED}.no
• {BLOCKED}ck.com
• {BLOCKED}kreader.de
• {BLOCKED}viser.com
• {BLOCKED}.at
• {BLOCKED}etxinh.com
• {BLOCKED}nnheim.de
• {BLOCKED}nskarna.se
• {BLOCKED}recorporatelaw.com
• {BLOCKED}ree.com
• {BLOCKED}e
• {BLOCKED}rdenstudentcity.nl
• {BLOCKED}ie
• {BLOCKED}r
• {BLOCKED}tliv.se
• {BLOCKED}u
• {BLOCKED}tedifiori.com
• {BLOCKED}aetstag.de
• {BLOCKED}.co.uk
• {BLOCKED}lische-pfarrgemeinde-tuniberg.de
• {BLOCKED}ra.com
• {BLOCKED}s.dk
• {BLOCKED}ouseusa.com
• {BLOCKED}nic.org
• {BLOCKED}deine-marke.de
• {BLOCKED}-bamboo-bikes.org
• {BLOCKED}an.de
• {BLOCKED}dia
• {BLOCKED}alentineacademy.com
• {BLOCKED}et
• {BLOCKED}roductkey.com
• {BLOCKED}ienda.com
• {BLOCKED}genius.com
• {BLOCKED}aby.com
• {BLOCKED}apuertorico.com
• {BLOCKED}essor.com
• {BLOCKED}yday-loans.com
• {BLOCKED}iends18.de
• {BLOCKED}osser.de
• {BLOCKED}i.com
• {BLOCKED}uettes.eu
• {BLOCKED}sdofarrobo.com
• {BLOCKED}rmachen.com
• {BLOCKED}andwichmadrid.es
• {BLOCKED}se.com
• {BLOCKED}nterprises.com
• {BLOCKED}tanacommittee.us
• {BLOCKED}rmacpc.com
• {BLOCKED}fplus.com
• {BLOCKED}dogshop.de
• {BLOCKED}nd-thermen-resort.com
• {BLOCKED}org
• {BLOCKED}escom.wordpress.com
• {BLOCKED}dvertising.com
• {BLOCKED}gfpt.info.vn
• {BLOCKED}inoc.com
• {BLOCKED}yyworkout.com
• {BLOCKED}ncesalextrespaille.fr
• {BLOCKED}nepenn.com
• {BLOCKED}gewerkschaften.de
• {BLOCKED}-frayssinet.fr
• {BLOCKED}dermatology.lt
• {BLOCKED}hers.com
• {BLOCKED}itysisters.org
• {BLOCKED}ervices.co.uk
• {BLOCKED}lamarketing.com
• {BLOCKED}ssthepepper.com
• {BLOCKED}ra.com
• {BLOCKED}ox.com
• {BLOCKED}lieru

Other Details

This Ransomware adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE
BlackLivesMatter =

It does the following:

• It will terminate itself if the affected system's keyboard layout is any of the following:
  • Arabic - Syria
  • Armenian - Armenia
  • Azerbaijani - Azerbaijan (Cyrillic)
  • Azerbaijani - Azerbaijan (Latin)
  • Belarusian
  • Georgian - Georgia
  • Kazakh - Kazakhstan
  • Kyrgyz - Kyrgyzstan
  • Romanian - (Moldova)
  • Russian
  • Russian - (Moldova)
  • Syriac - Syria
  • Tajikistan
  • Tatar - Russia
  • Turkmen-Turkmenistan
  • Ukrainian
  • Uzbek - Uzbekistan (Cyrillic)
  • Uzbek - Uzbekistan (Latin)
• It wipes the contents of the following folder(s):
  • backup
• It accepts the following arguments:
  • -silent - skips Termination of blacklisted processes and services
  • -path - specifies directory to be encrypted
  • -nolocal - avoids encrypting fixed and removable drives
  • -nolan - avoids encrypting network and shared drives
  • -fast - fast encryption mode
  • -full
• When another instance is running, Message Box appears:
  
• Injects Shellcode into itself.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• autorun.inf
• boot.ini
• bootfont.bin
• bootsect.bak
• desktop.ini
• iconcache.db
• ntldr
• ntuser.dat
• ntuser.dat.log
• ntuser.ini
• thumbs.db

It avoids encrypting files found in the following folders:

• $windows.~br
• $recycle.bin
• appdata
• application data
• google
• intel
• mozilla
• msocache
• program data
• perflogs
• program files
• Program Files (x86)
• system volume information
• tor broser
• windows
• windows.old

It appends the following extension to the file name of the encrypted files:

• .{Random Characters}

It drops the following file(s) as ransom note:

• {encrypted directory}\{appended extension}-readme.txt
  

It avoids encrypting files with the following file extensions:

• .386
• .adv
• .ani
• .bat
• .bin
• .cab
• .cmd
• .com
• .cpl
• .cur
• .deskthemepack
• .diagcab
• .diagcgf
• .diagpkg
• .dll
• .drv
• .exe
• .hlp
• .hta
• .icl
• .ldf
• .lock
• .icns
• .ico
• .ics
• .idx
• .key
• .lnk
• .mod
• .mpa
• .msc
• .msi
• .msp
• .msstyles
• .msu
• .nls
• .nomedia
• .ocx
• .prf
• .ps1
• .rom
• .rtp
• .scr
• .shs
• .spl
• .sys
• .theme
• .themepack
• .wpx