You do not have permission to edit this page, for the following reasons:

This IP address has been blocked from editing Wikipedia.
This does not affect your ability to read Wikipedia pages.
Most people who see this message have done nothing wrong. Some kinds of blocks restrict editing from specific service providers or telecom companies in response to recent abuse or vandalism, and can sometimes affect other users who are unrelated to that abuse. Review the information below for assistance if you do not believe that you have done anything wrong.

The IP address or range 54.163.0.0/16 has been blocked (disabled) by ‪Blablubbs‬ for the following reason(s):

The IP address that you are currently using has been blocked because it is believed to be a web host provider or colocation provider. To prevent abuse, web hosts and colocation providers may be blocked from editing Wikipedia.
You will not be able to edit Wikipedia using a web host or colocation provider because it hides your IP address, much like a proxy or VPN.
We recommend that you attempt to use another connection to edit. For example, if you use a proxy or VPN to connect to the internet, turn it off when editing Wikipedia. If you edit using a mobile connection, try using a Wi-Fi connection, and vice versa. If you are using a corporate internet connection, switch to a different Wi-Fi network. If you have a Wikipedia account, please log in.
If you do not have any other way to edit Wikipedia, you will need to request an IP block exemption.

How to appeal if you are confident that your connection does not use a colocation provider's IP address:
If you are confident that you are not using a web host, you may appeal this block by adding the following text on your talk page: ((unblock|reason=Caught by a colocation web host block but this host or IP is not a web host. My IP address is _______. Place any further information here. ~~~~)). You must fill in the blank with your IP address for this block to be investigated. Your IP address can be determined here. Alternatively, if you wish to keep your IP address private you can use the unblock ticket request system. There are several reasons you might be editing using the IP address of a web host or colocation provider (such as if you are using VPN software or a business network); please use this method of appeal only if you think your IP address is in fact not a web host or colocation provider.

Administrators: The IP block exemption user right should only be applied to allow users to edit using web host in exceptional circumstances, and requests should usually be directed to the functionaries team via email. If you intend to give the IPBE user right, a CheckUser needs to take a look at the account. This can be requested most easily at SPI Quick Checkuser Requests. Unblocking an IP or IP range with this template is highly discouraged without at least contacting the blocking administrator.

This block will expire on 17:28, 10 March 2024.

Even when blocked, you will usually still be able to edit your user talk page, as well as email administrators and other editors.

For information on how to proceed, please read the FAQ for blocked users and the guideline on block appeals. The guide to appealing blocks may also be helpful.

Other useful links: Blocking policy · Help:I have been blocked
Your IP address is in a range that has been blocked on all Wikimedia Foundation wikis. The block was made by ‪Jon Kolbert‬. The reason given is Open proxy/Webhost: See the help page if you are affected .
- Start of block: 18:27, 12 November 2023
- Expiry of block: 18:27, 12 November 2028
Your current IP address is 54.163.179.242. The blocked range is 54.163.0.0/16. Please include all above details in any queries you make. If you believe you were blocked by mistake, you can find additional information and instructions in the No open proxies global policy. Otherwise, to discuss the block please post a request for review on Meta-Wiki. You could also send an email to the stewards VRT queue at stewards@wikimedia.org including all above details.

You can view and copy the source of this page:

((Short description|Joke ransomware))
((Infobox software
| name = Rensenware
| logo = 
| screenshot = Rensenware.webp
| screenshot size = 200px
| caption = Rensenware main window
| author = Kangjun Heo
| developer = 
| repo = ((URL|https://github.com/0x00000FF/rensenware-cut|GitHub))
| programming language = [[C_Sharp_(programming_language)|C#]]
| operating_system = [[Windows]]
| language = 
| genre = [[Ransomware]]
| license = [[GNU General Public License|GNU GPL]] (backend)
| website = 
))
'''Rensenware''' (((lang-ko|련선웨어)); stylized as '''rensenWare''') is [[ransomware]] that infects [[Microsoft Windows|Windows]] computers. It was created as a joke by Kangjun Heo (((lang|ko|허강준)); alias "0x00000FF") and first appeared in 2017. Rensenware is unusual as an example of ransomware in that it does not request the user pay the creator of the virus to [[decrypt]] their files, instead requiring the user to achieve a required number of points in the [[bullet hell]] game ''[[Undefined Fantastic Object|Touhou Seirensen ~ Undefined Fantastic Object]]'' before any decryption can take place. The main window displays [[Minamitsu Murasa]], a character from the game. Heo released a patch that neutralizes Rensenware after the malware gained attention.

== Description ==
Rensenware was developed by Korean undergraduate student and programmer Kangjun Heo for [[Windows]] operating systems out of boredom as a joke within the ''[[Touhou Project]]'' fandom.<ref>((Cite web |url=https://github.com/0x00000FF |title=0x00000FF - Overview |via=GitHub |language=en |access-date=2020-01-21 |archive-date=2019-08-04 |archive-url=https://web.archive.org/web/20190804074919/https://github.com/0x00000FF |url-status=live ))</ref><ref>((cite web|url=https://kotaku.com/anime-malware-locks-your-files-unless-you-play-a-game-1794120750|title=Anime Malware Locks Your Files Unless You Play A Game|last=D'Anastasio|first=Cecilia|website=[[Kotaku]]|date=April 7, 2017|access-date=December 11, 2022|archive-url=https://web.archive.org/web/20221130221224/https://kotaku.com/anime-malware-locks-your-files-unless-you-play-a-game-1794120750|archive-date=November 30, 2022|url-status=live))</ref> When executed, the program scans and encrypts all files on the computer that end in certain [[Filename extension|extensions]] using [[AES-256]] and appends ".RENSENWARE" to the [[filename]].<ref name="Abrams 2017">((cite web|url=https://www.bleepingcomputer.com/news/security/rensenware-will-only-decrypt-files-if-victim-scores-2-billion-in-th12-game/|title=RensenWare Will Only Decrypt Files if Victim Scores .2 Billion in TH12 Game|last=Abrams|first=Lawrence|website=[[Bleeping Computer]]|date=April 6, 2017|access-date=December 11, 2022|archive-url=https://web.archive.org/web/20221128032217/https://www.bleepingcomputer.com/news/security/rensenware-will-only-decrypt-files-if-victim-scores-2-billion-in-th12-game/|archive-date=November 28, 2022|url-status=live))</ref> The ransomware was first discovered by MalwareHunterTeam on April 6, 2017.<ref name="Ars">((Cite web|url=https://arstechnica.com/gaming/2017/04/do-you-want-to-play-a-game-ransomware-asks-for-high-score-instead-of-money/|title=Do you want to play a game? Ransomware asks for high score instead of money|last=Orland|first=Kyle|date=2017-04-07|website=[[Ars Technica]]|language=en-us|access-date=2020-02-01|archive-date=2020-02-01|archive-url=https://web.archive.org/web/20200201165214/https://arstechnica.com/gaming/2017/04/do-you-want-to-play-a-game-ransomware-asks-for-high-score-instead-of-money/|url-status=live))</ref>

=== Payload ===
Once the files have been encrypted, a warning window depicting the character [[Minamitsu Murasa]] from the ''Touhou Project'' is displayed, which cannot be closed. The program requires the user to play the [[bullet hell]] video game ''[[Undefined Fantastic Object|Touhou Seirensen ~ Undefined Fantastic Object]]'', which is not included with the software meaning they must download it on their own,<ref name="Ars" /> and score at least 200&nbsp;million points in the "Lunatic" level of difficulty before any decryption may take place (the program automatically detects the game's [[Process (computing)|process]] "th12" and its accumulated points). The [[Payload (computing)|payload]] window advises the user not to kill the Rensenware main program until their files have successfully been decrypted, otherwise they will lose them permanently as the decryption keys are not locally stored.<ref name="Abrams 2017" />

== Neutralisation tool ==
Heo accidentally infected himself while programming the software and found that he was unable to get the necessary score. He later released a piece of software that neutralized Rensenware (by setting a custom score and injecting it into the game, satisfying the Rensenware program requirements)<ref name="Ars" /><ref name="Verge">((Cite web|url=https://www.theverge.com/2017/4/7/15224264/rensenware-ransomware-virus-lock-files-anime-bullet-hell-shooter|title=New ransomware locks your files behind an anime bullet hell shooter|last=Gartenberg|first=Chaim|date=2017-04-07|website=[[The Verge]]|language=en|access-date=2020-01-21|archive-date=2020-01-20|archive-url=https://web.archive.org/web/20200120232001/https://www.theverge.com/2017/4/7/15224264/rensenware-ransomware-virus-lock-files-anime-bullet-hell-shooter|url-status=live))</ref> onto [[GitHub]] with an apology.<ref>((Cite web|last=Good|first=Owen S.|date=2017-04-09|title=Virus locks out data, unless you can score 200 million in an impossible game|url=https://www.polygon.com/2017/4/9/15237830/ransomware-anime-shooter-bullet-hell-rensenware-undefined-fantastic-object-touhou-seirensen|access-date=2021-04-03|website=[[Polygon (website)|Polygon]]|archive-date=2021-04-10|archive-url=https://web.archive.org/web/20210410114057/https://www.polygon.com/2017/4/9/15237830/ransomware-anime-shooter-bullet-hell-rensenware-undefined-fantastic-object-touhou-seirensen|url-status=live))</ref> He also released a small part of the ransomware source code without the payload.<ref name="Verge" />

== References ==
((Reflist))

== External links ==
*((GitHub|0x00000FF/rensenware-cut|rensenWare))

((Touhou Project))
((Hacking in the 2010s))
[[Category:Ransomware]]
[[Category:Touhou Project]]

Pages transcluded onto the current version of this page (help):

Rensenware (edit)
Template:Cite web (view source) (protected)
Template:Delink question hyphen-minus (view source) (template editor protected)
Template:GitHub (view source) (semi-protected)
Template:Hacking in the 2010s (edit)
Template:Hlist/styles.css (view source) (protected)
Template:If empty (view source) (protected)
Template:Ill (view source) (template editor protected)
Template:Infobox (view source) (template editor protected)
Template:Infobox software (view source) (template editor protected)
Template:Infobox software/simple (view source) (template editor protected)
Template:Interlanguage link (view source) (template editor protected)
Template:Lang (view source) (template editor protected)
Template:Lang-ko (view source) (template editor protected)
Template:Main other (view source) (protected)
Template:Navbox (view source) (template editor protected)
Template:Pagetype (view source) (protected)
Template:Reflist (view source) (protected)
Template:Reflist/styles.css (view source) (protected)
Template:SDcat (view source) (protected)
Template:Separated entries (view source) (template editor protected)
Template:Short description (view source) (protected)
Template:Short description/lowercasecheck (view source) (protected)
Template:Succession links (view source) (template editor protected)
Template:Template other (view source) (protected)
Template:Touhou Project (edit)
Template:URL (view source) (template editor protected)
Template:Wikidata (view source) (template editor protected)
Module:Arguments (view source) (protected)
Module:Check for unknown parameters (view source) (protected)
Module:Citation/CS1 (view source) (protected)
Module:Citation/CS1/COinS (view source) (protected)
Module:Citation/CS1/Configuration (view source) (protected)
Module:Citation/CS1/Date validation (view source) (protected)
Module:Citation/CS1/Identifiers (view source) (protected)
Module:Citation/CS1/Utilities (view source) (protected)
Module:Citation/CS1/Whitelist (view source) (protected)
Module:Citation/CS1/styles.css (view source) (protected)
Module:Disambiguation/templates (view source) (protected)
Module:Exponential search (view source) (template editor protected)
Module:If empty (view source) (protected)
Module:Infobox (view source) (template editor protected)
Module:Infobox/styles.css (view source) (template editor protected)
Module:InfoboxImage (view source) (template editor protected)
Module:Lang (view source) (template editor protected)
Module:Lang/ISO 639 synonyms (view source) (template editor protected)
Module:Lang/data (view source) (template editor protected)
Module:Language/data/iana languages (view source) (template editor protected)
Module:Language/data/iana regions (view source) (template editor protected)
Module:Language/data/iana scripts (view source) (template editor protected)
Module:Language/data/iana suppressed scripts (view source) (template editor protected)
Module:Language/data/iana variants (view source) (template editor protected)
Module:MultiReplace (view source) (template editor protected)
Module:Navbar (view source) (protected)
Module:Navbar/configuration (view source) (protected)
Module:Navbar/styles.css (view source) (protected)
Module:Navbox (view source) (template editor protected)
Module:Navbox/configuration (view source) (template editor protected)
Module:Navbox/styles.css (view source) (template editor protected)
Module:Pagetype (view source) (protected)
Module:Pagetype/config (view source) (protected)
Module:Pagetype/disambiguation (view source) (protected)
Module:Pagetype/setindex (view source) (protected)
Module:Pagetype/softredirect (view source) (protected)
Module:SDcat (view source) (protected)
Module:Separated entries (view source) (protected)
Module:String (view source) (protected)
Module:TableTools (view source) (protected)
Module:URL (view source) (template editor protected)
Module:Unicode data (view source) (template editor protected)
Module:Unicode data/scripts (view source) (template editor protected)
Module:Wd (view source) (template editor protected)
Module:Wd/i18n (view source) (template editor protected)
Module:Wikitext Parsing (view source) (protected)
Module:Yesno (view source) (protected)

Return to Rensenware.

Retrieved from "https://en.wikipedia.org/wiki/Rensenware"