Ransom.Win64.DONOTRUN.A

Publish Date: 25 April 2023

Analyse von: Rojan Dela Cruz

Python/Filecoder.EK trojan, Python/Filecoder.EK trojan (NAI)

Plattform:

Windows

Risikobewertung (gesamt):

Schadenspotenzial::

Verteilungspotenzial::

reportedInfection:

Trend Micro Lösungen:

Niedrig

Mittel

Hoch

Kritisch

Malware-Typ:
Ransomware
Zerstrerisch?:
Nein
Verschlsselt?:
In the wild::
Ja

Überblick

Infektionsweg: Aus dem Internet heruntergeladen, Fallen gelassen von anderer Malware

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Technische Details

Dateigröße: 42,802,317 bytes

Dateityp: , EXE

Speicherresiden: Nein

Schadteil: Disables desktop, Connects to URLs/IPs, Displays message/message boxes

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

%Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll

(Hinweis: %Temp% ist der Windows Ordner für temporäre Dateien, normalerweise C:\Windows\Temp oder C:\WINNT\Temp.)

Fügt die folgenden Prozesse hinzu:

{Malware Path}\{Malware File Name}.exe
%System%\cmd.exe /c sc stop WinDefend
%System%\sc.exe /c sc stop WinDefend
%System%\cmd.exe /c "ver"
%System%\conhost.exe 0xffffffff –ForceV1
%System%\conhost.exe 0xffffffff –ForceV1

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Erstellt die folgenden Ordner:

%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

(Hinweis: %Temp% ist der Windows Ordner für temporäre Dateien, normalerweise C:\Windows\Temp oder C:\WINNT\Temp.)

Andere Details

It connects to the following possibly malicious URL:

discord.com:{BLOCKED}3
api.ipify.org:{BLOCKED}3

Es macht Folgendes:

It locks the screen and displays the following image:

Lösungen

Mindestversion der Scan Engine: 9.800

Erste VSAPI Pattern-Datei: 18.380.52

Erste VSAPI Pattern veröffentlicht am: 14 April 2023

VSAPI OPR Pattern-Version: 18.381.00

VSAPI OPR Pattern veröffentlicht am: 15 April 2023

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

<p> Beachten Sie, dass nicht alle Dateien, Ordner, Registrierungsschlüssel und Einträge auf Ihrem Computer installiert sind, während diese Malware / Spyware / Grayware ausgeführt wird. Dies kann auf eine unvollständige Installation oder andere Betriebssystembedingungen zurückzuführen sein. Fahren Sie mit dem nächsten Schritt fort. </ p><p> Beachten Sie, dass nicht alle Dateien, Ordner, Registrierungsschlüssel und Einträge auf Ihrem Computer installiert sind, während diese Malware / Spyware / Grayware ausgeführt wird. Dies kann auf eine unvollständige Installation oder andere Betriebssystembedingungen zurückzuführen sein. Fahren Sie mit dem nächsten Schritt fort. </ p>

Step 3

Im abgesicherten Modus neu starten

[ learnMore ]

Step 4

Diese Dateien suchen und löschen

[ learnMore ]

Möglicherweise sind einige Komponentendateien verborgen. Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter "Weitere erweiterte Optionen", um alle verborgenen Dateien und Ordner in den Suchergebnissen zu berücksichtigen.

%Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll
%Desktop%\readme.txt

DATA_GENERIC_FILENAME_1

Wählen Sie im Listenfeld lt;i>Suchen in die Option Arbeitsplatz, und drücken Sie die Eingabetaste.

Markieren Sie die gefundene Datei, und drücken Sie UMSCHALT+ENTF, um sie endgültig zu löschen.

Wiederholen Sie die Schritte 2 bis 4 für die übrigen Dateien: %Temp%\_MEI{random 5 characters}\certifi\cacert.pem
%Temp%\_MEI{random 5 characters}\certifi\py.typed
%Temp%\_MEI{random 5 characters}\charset_normalizer\md.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_ARC4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_chacha20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_pkcs1_decode.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aes.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_aesni.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_arc2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_blowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cast.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cbc.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_cfb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ctr.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_des3.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ecb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_eksblowfish.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ocb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_raw_ofb.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Cipher\_Salsa20.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2b.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_BLAKE2s.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_clmul.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_ghash_portable.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_keccak.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD2.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD4.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_MD5.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_poly1305.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_RIPEMD160.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA1.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA224.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA256.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA384.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Hash\_SHA512.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Math\_modexp.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Protocol\_scrypt.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ec_ws.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed448.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_ed25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey\_x25519.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_cpuid_c.pyd
%Temp%\_MEI{random 5 characters}\Crypto\Util\_strxor.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\d3dcompiler_47.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libEGL.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\libGLESv2.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\MSVCP140_1.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\opengl32sw.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Core.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5DBus.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Gui.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Network.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Qml.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5QmlModels.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Quick.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin\Qt5Widgets.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qgif.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qico.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qjpeg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qsvg.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats\qwbmp.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qminimal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwebgl.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms\qwindows.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ar.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_bg.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ca.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_cs.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_de.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_en.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_es.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fi.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_fr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_gd.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_hu.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_it.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ko.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_lv.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_pl.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_ru.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_sk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_tr.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_uk.qm
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations\qtbase_zh_TW.qm
%Temp%\_MEI{random 5 characters}\PyQt5\QtCore.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtGui.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\QtWidgets.pyd
%Temp%\_MEI{random 5 characters}\PyQt5\win_amd64.pyd
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\entry_points.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\INSTALLER
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\LICENSE
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\METADATA
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\RECORD
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\REQUESTED
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\top_level.txt
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info\WHEEL
%Temp%\_MEI{random 5 characters}\_asyncio.pyd
%Temp%\_MEI{random 5 characters}\_bz2.pyd
%Temp%\_MEI{random 5 characters}\_cffi_backend.cp311-win_amd64.pyd
%Temp%\_MEI{random 5 characters}\_ctypes.pyd
%Temp%\_MEI{random 5 characters}\_decimal.pyd
%Temp%\_MEI{random 5 characters}\_hashlib.pyd
%Temp%\_MEI{random 5 characters}\_lzma.pyd
%Temp%\_MEI{random 5 characters}\_multiprocessing.pyd
%Temp%\_MEI{random 5 characters}\_overlapped.pyd
%Temp%\_MEI{random 5 characters}\_queue.pyd
%Temp%\_MEI{random 5 characters}\_socket.pyd
%Temp%\_MEI{random 5 characters}\_ssl.pyd
%Temp%\_MEI{random 5 characters}\api-ms-win-core-console-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-datetime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-debug-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-errorhandling-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-file-l2-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-handle-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-interlocked-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-libraryloader-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-localization-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-memory-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-namedpipe-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processenvironment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-processthreads-l1-1-1.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-profile-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-rtlsupport-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-synch-l1-2-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-sysinfo-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-timezone-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-core-util-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-conio-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-convert-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-environment-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-filesystem-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-heap-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-locale-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-math-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-process-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-runtime-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-string-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\api-ms-win-crt-utility-l1-1-0.dll
%Temp%\_MEI{random 5 characters}\base_library.zip
%Temp%\_MEI{random 5 characters}\libcrypto-1_1.dll
%Temp%\_MEI{random 5 characters}\libffi-8.dll
%Temp%\_MEI{random 5 characters}\libssl-1_1.dll
%Temp%\_MEI{random 5 characters}\pyexpat.pyd
%Temp%\_MEI{random 5 characters}\python3.dll
%Temp%\_MEI{random 5 characters}\python311.dll
%Temp%\_MEI{random 5 characters}\select.pyd
%Temp%\_MEI{random 5 characters}\ucrtbase.dll
%Temp%\_MEI{random 5 characters}\unicodedata.pyd
%Temp%\_MEI{random 5 characters}\VCRUNTIME140.dll
%Temp%\_MEI{random 5 characters}\VCRUNTIME140_1.dll
%Desktop%\readme.txt

Step 5

Diese Ordner suchen und löschen

[ learnMore ]

Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter Weitere erweiterte Optionen, um alle verborgenen Ordner in den Suchergebnissen zu berücksichtigen.

%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

Die Malware-/Grayware-/Spyware-Ordner löschen:

Klicken Sie mit der rechten Maustaste auf Start und dann je nach Windows Version auf Suchen... oder Finden....
Geben Sie in das Feld Name Folgendes ein:

%Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info
Wählen Sie im Listenfeld lt;i>Suchen in die Option Arbeitsplatz, und drücken Sie die Eingabetaste.
Markieren Sie den gefundenen Ordner, und drücken Sie UMSCHALT+ENTF, um ihn endgültig zu löschen.
Wiederholen Sie die Schritte 2 bis 4 für die übrigen Ordner: %Temp%\_MEI{random 5 characters}
%Temp%\_MEI{random 5 characters}\certifi
%Temp%\_MEI{random 5 characters}\charset_normalizer
%Temp%\_MEI{random 5 characters}\Crypto
%Temp%\_MEI{random 5 characters}\Crypto\Cipher
%Temp%\_MEI{random 5 characters}\Crypto\Hash
%Temp%\_MEI{random 5 characters}\Crypto\Math
%Temp%\_MEI{random 5 characters}\Crypto\Protocol
%Temp%\_MEI{random 5 characters}\Crypto\PublicKey
%Temp%\_MEI{random 5 characters}\Crypto\Util
%Temp%\_MEI{random 5 characters}\PyQt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\bin
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\translations
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\generic
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\iconengines
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\imageformats
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platforms
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\platformthemes
%Temp%\_MEI{random 5 characters}\PyQt5\Qt5\plugins\styles
%Temp%\_MEI{random 5 characters}\setuptools-65.5.0.dist-info

Step 6

Führen Sie den Neustart im normalen Modus durch, und durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt nach Dateien, die als Ransom.Win64.DONOTRUN.A entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.

Nehmen Sie an unserer Umfrage teil

Ransom.Win64.DONOTRUN.A

Überblick

Technische Details

Lösungen

Ressourcen

Support

Über Trend

Hauptniederlassung DACH

Ransom.Win64.DONOTRUN.A

Überblick

Technische Details

Lösungen

Ressourcen

Support

Über Trend

Hauptniederlassung DACH

Nord-, Mittel- und Südamerika

Naher Osten und Afrika

Europa

Asien-Pazifik