Program, information processing device, and information processing method

A non-transitory computer-readable computer medium storing a program for causing a computer to execute as a judging step for judging a predetermined process as a ransomware,

• when a first condition that a file read function for reading a file included in a same file path as a file path deleted by a file delete function called from the predetermined process has been already called from the predetermined process;
• a second condition that a first file move function specifying a same file path as the file path deleted by the file delete function from the predetermined process as a destination path has been already called from the predetermined process;
• a third condition that a file write function for writing data to a file in a same file path as a file path specified as a source path of a second file move function called from the predetermined process has been already called from the predetermined process;
• and a fourth condition that a header of a file in a source path of the first file move function is different from a header of the file included in the file path deleted by the file delete function:
• are satisfied.

A non-transitory computer-readable computer medium storing a program for causing a computer to execute as a judging step for judging a predetermined process as a ransomware,

• when a first condition that a file read function for reading a file included in a same file path as a file path specified as a destination path by a file move function called from the predetermined process has been already called from the predetermined process;
• a second condition that a file write function for writing data to a file in a same file path as a file path specified as a source path by the file move function has been already called from the predetermined process;
• and a third condition that a header of a file in the source path of the file move function is different from a header of a file in the destination path of the file move function:
• are satisfied.