Trojan.MulDrop11.20197

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\rica67lm] 'Driver' = 'rica67lm.dll'

Modifies file system

Creates the following files

%TEMP%\7zs862e9610\1561536545_43_1561358525_1561537174.msi
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3056.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3077.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set30d5.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set30e6.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3106.tmp
<SYSTEM32>\set3126.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rica67gr.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3025.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3036.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rica67ui.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67ui.irj
<SYSTEM32>\spool\drivers\x64\3\new\rica67ui.rdj
<SYSTEM32>\spool\drivers\x64\3\new\rica67ui.rcf
<SYSTEM32>\spool\drivers\x64\3\new\rica67ug.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67ug.miz
<SYSTEM32>\spool\drivers\x64\3\new\rica67ur.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67gl.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67cd.psz
<SYSTEM32>\spool\drivers\x64\3\new\rica67ch.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica67cd.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67ci.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2ecb.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setad32.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setae0e.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2b33.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bb1.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bc2.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2edb.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setaa42.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2f1b.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2be2.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2cc1.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d20.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d40.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d80.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2e2c.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2e4d.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bf3.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2ca0.tmp
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2cb0.tmp
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_2.ssd
<SYSTEM32>\spool\drivers\x64\3\new\rica67cf.cfz
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_korean.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_polish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_portuguese.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_russian.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_simplifiedchinese.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_spanish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_swedish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_italian.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_traditionalchinese.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_norwegian.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\jobhook.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\popup.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\printercopyguardpreview.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\printerpreventioncopypatternpreview.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\secretnumberingpreview.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\watermark.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\watermarkpreview.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_turkish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_hungarian.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\outputimage.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_greek.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_german.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica67cz.dlz
<SYSTEM32>\spool\drivers\x64\3\new\rica67ct.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67cb.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67tl.exe
<SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\3\new\rd067d64.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\borderline.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\colorbalance.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica67cj.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\headerfooter.dll
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_catalan.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_czech.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_danish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_dutch.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_english.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_finnish.chm
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_french.chm
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta83e.tmp
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\dlz\help\rica67ui_brazilian.chm
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setabca.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta629.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta4b1.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta349.tmp
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ug.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ug.miz
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ui.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ui.irj
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ui.rcf
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ui.rdj
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67lm.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67gl.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\oemsetup.inf
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ur.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67.cat
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cb.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cd.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cd.psz
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cf.cfz
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\actiondata.chk
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\ricdb64.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rd067d64.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\readme.html
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67gr.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cz.dlz
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\actiondata.psd
%TEMP%\7zs862e9610\rp_tools_lng.irc
%TEMP%\7zs862e9610\pinst.exe
%TEMP%\7zs862e9610\riusrswitcher.exe
%TEMP%\7zs862e9610\libeay32.dll
%PROGRAMDATA%\ricoh\pdplog\jhtotrlafbe_10102019_000721.riusrswitcher.log
%PROGRAMDATA%\ricoh\rp_tools_lng.irc
%PROGRAMDATA%\msilog\jhtotrlafbe_10102019_000722_pdp_installer.log
%PROGRAMDATA%\ricoh\pdplog\jhtotrlafbe_10102019_000733.rpicheck.log
%TEMP%\7zs862e9610\pinst.bat
%PROGRAMDATA%\ricoh\rpicheck.ini
%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\difxapi.dll
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\mfricr64.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\oemsetup.dsc
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ch.chm
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ci.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cj.dl_
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67cl.ini
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67ct.dl_
%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\rputil.exe
%PROGRAMDATA%\ricoh_drv\ricoh mp 2555 pcl 6\_common\cfz_index.dat
<SYSTEM32>\spool\drivers\x64\3\new\rica67cl.ini
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_11.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_5.ssd
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8d8e.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8f16.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8ff1.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set90dd.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set92f1.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set93fc.tmp
%PROGRAMDATA%\ricoh\pdplog\jhtotrlafbe_10102019_000736.rputil.log
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9583.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8bc8.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9873.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9ba2.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9ccc.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9db7.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9eb2.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9fdc.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta144.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set969e.tmp
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\rica67tl.ex_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9a59.tmp
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8a50.tmp
%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\1561358508.rcf
%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\1561536545_43_1561358525.ini
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_6.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_7.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_8.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_9.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\specfilter.dat
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\innerdata.chk
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\innerdata.psd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_4.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\modelssdlist.msl
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd.psd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_0.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_1.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_10.ssd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\plugin\headerfooter\headerfooter.chk
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\plugin\headerfooter\headerfooter.psd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\plugin\headerfooter\plugininnerdata.chk
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\plugin\headerfooter\plugininnerdata.psd
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd.chk
%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\irc\rp_tools_lng.irc
%ProgramFiles(x86)%\ricoh\printer\1561358500_09-13-2016\disk1\psz\rica67cd_3.ssd
%TEMP%\dmi7af9.tmp.log.xml

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Deletes the following files

%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\mfricr64.dl_
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cf.cfz
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ch.chm
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ci.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cj.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cl.ini
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ct.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cz.dlz
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67gl.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67gr.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67tl.exe
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cd.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cd.psz
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ug.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.irj
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.rcf
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.rdj
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ur.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\ricdb64.dll
%TEMP%\dmi7af9.tmp.log.xml
%TEMP%\7zs862e9610\1561536545_43_1561358525_1561537174.msi
%TEMP%\7zs862e9610\libeay32.dll
%TEMP%\7zs862e9610\pinst.bat
%TEMP%\7zs862e9610\pinst.exe
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ug.miz
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cb.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rd067d64.dll
<SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\mfricr64.dll
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rd067d64.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67.cat
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cb.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cd.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cd.psz
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cf.cfz
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ch.chm
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ci.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cj.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cl.ini
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ct.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\oemsetup.inf
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cz.dlz
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67gr.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67lm.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67tl.ex_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ug.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ug.miz
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.irj
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.rcf
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.rdj
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ur.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\ricdb64.dl_
%TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67gl.dl_
%TEMP%\7zs862e9610\riusrswitcher.exe
%TEMP%\7zs862e9610\rp_tools_lng.irc

Moves the following system files

from <SYSTEM32>\catroot2\edb00562.log to <SYSTEM32>\catroot2\edbtmp.log
from <SYSTEM32>\catroot2\edb.log to <SYSTEM32>\catroot2\edb00563.log

Moves the following files

from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8a50.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cb.dl_
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ui.dll to <SYSTEM32>\spool\drivers\x64\3\rica67ui.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67gr.dll to <SYSTEM32>\spool\drivers\x64\3\rica67gr.dll
from <SYSTEM32>\set3126.tmp to <SYSTEM32>\rica67lm.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3106.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rd067d64.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set30e6.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set30d5.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cd.psz to <SYSTEM32>\spool\drivers\x64\3\rica67cd.psz
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3077.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67tl.exe
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3036.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ct.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3025.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cj.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2f1b.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cz.dlz
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2edb.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ch.chm
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2ecb.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cl.ini
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2e4d.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cf.cfz
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set3056.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cb.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ch.chm to <SYSTEM32>\spool\drivers\x64\3\rica67ch.chm
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ui.irj to <SYSTEM32>\spool\drivers\x64\3\rica67ui.irj
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ui.rdj to <SYSTEM32>\spool\drivers\x64\3\rica67ui.rdj
from <SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll to <SYSTEM32>\spool\drivers\x64\3\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67tl.exe to <SYSTEM32>\spool\drivers\x64\3\rica67tl.exe
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cb.dll to <SYSTEM32>\spool\drivers\x64\3\rica67cb.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ct.dll to <SYSTEM32>\spool\drivers\x64\3\rica67ct.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cj.dll to <SYSTEM32>\spool\drivers\x64\3\rica67cj.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cz.dlz to <SYSTEM32>\spool\drivers\x64\3\rica67cz.dlz
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cl.ini to <SYSTEM32>\spool\drivers\x64\3\rica67cl.ini
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cf.cfz to <SYSTEM32>\spool\drivers\x64\3\rica67cf.cfz
from <SYSTEM32>\spool\drivers\x64\3\new\rica67cd.dll to <SYSTEM32>\spool\drivers\x64\3\rica67cd.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ci.dll to <SYSTEM32>\spool\drivers\x64\3\rica67ci.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67gl.dll to <SYSTEM32>\spool\drivers\x64\3\rica67gl.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ur.dll to <SYSTEM32>\spool\drivers\x64\3\rica67ur.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ug.miz to <SYSTEM32>\spool\drivers\x64\3\rica67ug.miz
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ug.dll to <SYSTEM32>\spool\drivers\x64\3\rica67ug.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica67ui.rcf to <SYSTEM32>\spool\drivers\x64\3\rica67ui.rcf
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2e2c.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cd.psz
from <SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll to <SYSTEM32>\spool\drivers\x64\3\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d80.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67cd.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d20.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67gl.dll
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9db7.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ur.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9ccc.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\mfricr64.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9ba2.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cl.ini
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9a59.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9873.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cf.cfz
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set969e.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ug.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9eb2.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.rcf
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9583.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67lm.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set92f1.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ct.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set90dd.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ch.chm
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8ff1.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67gl.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8f16.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cj.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8d8e.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ci.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set8bc8.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cd.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set93fc.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67gr.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\set9fdc.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67tl.ex_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta144.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.rdj
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta349.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ui.irj
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2cc1.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67gr.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2cb0.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ur.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2ca0.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ug.miz
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bf3.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ug.dll
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2be2.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.rcf
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bc2.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.rdj
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2bb1.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.irj
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2b33.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ui.dll
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setae0e.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\ricdb64.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setad32.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rd067d64.dl_
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setabca.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67.cat
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\setaa42.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\oemsetup.inf
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta83e.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67ug.miz
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta629.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cz.dlz
from %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\seta4b1.tmp to %TEMP%\{3e6f84cd-80b6-5750-c74e-7623cc999775}\rica67cd.psz
from <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\set2d40.tmp to <SYSTEM32>\spool\drivers\x64\{d77cf1c3-2ad4-4a4c-b708-353ef5ac709b}\rica67ci.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rd067d64.dll to <SYSTEM32>\spool\drivers\x64\3\rd067d64.dll

Miscellaneous

Creates and executes the following

'%TEMP%\7zs862e9610\riusrswitcher.exe' /C "PINST.exe" /H /A x64
'%TEMP%\7zs862e9610\pinst.exe'
'%ProgramFiles(x86)%\ricoh\queue\{9050e330-7205-409e-ad36-8fbd8b972ba7}_1561536545_43_1561358525\rputil.exe' -i -e -f 1561536545_43_1561358525.ini
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS862E9610\PINST.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS862E9610\PINST.bat"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS862E9610\PINST.exe"
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS862E9610\PINST.bat"
'%WINDIR%\syswow64\msiexec.exe' /i 1561536545_43_1561358525_1561537174.msi /norestart /passive /l*vx+ "%PROGRAMDATA%\msilog\jhtotrlafbe_10102019_000722_pdp_installer.log"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{24c98abb-11c7-4895-8349-cbcd6fd7ab82} "(null)"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{d0fc2dc5-9a1f-47d3-a38f-26e639ef542c} "(null)"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней