Ransom.Win64.DONOTRUN.A

2023年4月25日

分析者: Rojan Dela Cruz

Python/Filecoder.EK trojan, Python/Filecoder.EK trojan (NAI)

平台:

Windows

总体风险等级:

潜在破坏:

潜在分布:

感染次数:

信息暴露:

恶意软件类型:
Ransomware
有破坏性？:
没有
加密？:
In the Wild:
是的

概要

感染途徑: 从互联网上下载，或由其他恶意软件释放。

它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。

技术详细信息

文件大小: 42,802,317 bytes

报告日期: , EXE

内存驻留: 没有

Payload: 禁用桌面, 连接到 URL/Ip, 显示消息/消息框

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它植入下列文件：

%Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll

(注意: %Temp% 是 Windows 的临时文件夹，通常位于 C:\WINDOWS\Temp 或 C:\WINNT\Temp。)

它添加下列进程：

{Malware Path}\{Malware File Name}.exe
%System%\cmd.exe /c sc stop WinDefend
%System%\sc.exe /c sc stop WinDefend
%System%\cmd.exe /c "ver"
%System%\conhost.exe 0xffffffff –ForceV1
%System%\conhost.exe 0xffffffff –ForceV1

(注意: %System% 是 Windows 的 system 文件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)

它创建下列文件夹：

%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

(注意: %Temp% 是 Windows 的临时文件夹，通常位于 C:\WINDOWS\Temp 或 C:\WINNT\Temp。)

其他详细信息

It connects to the following possibly malicious URL:

discord.com:{BLOCKED}3
api.ipify.org:{BLOCKED}3

该程序执行以下操作：

It locks the screen and displays the following image:

解决方案

最小扫描引擎: 9.800

First VSAPI Pattern File: 18.380.52

VSAPI 第一样式发布日期: 2023年4月14日

VSAPI OPR样式版本: 18.381.00

VSAPI OPR样式发布日期: 2023年4月15日

Step 1

对于Windows ME和XP用户，在扫描前，请确认已禁用系统还原功能，才可全面扫描计算机。

Step 2

请注意，在执行此恶意软件/间谍软件/灰色软件期间，并非所有文件、文件夹、注册表项和条目都安装在您的计算机上。这可能是由于安装不完整或其他操作系统条件造成的。如果找不到相同的文件/文件夹/注册表信息，请继续下一步。

Step 3

重启进入安全模式

[ 更多 ]

Step 4

搜索和删除这些文件

[ 更多 ]

有些组件文件可能是隐藏的。请确认在"高级选项"中已选中搜索隐藏文件和文件夹复选框，使查找结果包括所有隐藏文件和文件夹。

%Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll
%Desktop%\readme.txt

DATA_GENERIC_FILENAME_1

在查找范围下拉列表中，选择

我的电脑然后回车确认。

一旦找到，请选择文件，然后按下SHIFT+DELETE彻底删除文件。

对剩余的文件重复第2到4步： %Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll
%Desktop%\readme.txt

Step 5

搜索和删除这些文件夹

[ 更多 ]

请确认在高级选项中已选中搜索隐藏文件和文件夹复选框，使查找结果包括所有隐藏文件夹。;
%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

删除恶意软件/灰色软件/间谍软件文件夹：

右键单击然后搜索...或查找...（具体取决于您运行的Windows版本）。

在“要搜索的文件或文件夹名为”输入框，输入：

%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

在查找范围下拉列表中，选择
我的电脑然后回车确认。

一旦找到，请选择文件夹，然后按下SHIFT+DELETE彻底删除文件夹。

对剩余的文件夹重复第2到4步： %Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

Step 6

重启进入正常模式，使用亚信安全产品扫描计算机，检测Ransom.Win64.DONOTRUN.A文件如果检测到的文件已被亚信安全产品清除、删除或隔离，则无需采取进一步措施。可以选择直接删除隔离的文件。请参阅知识库页面了解详细信息。