Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Control\Print\Monitors\rica6Hlm] 'Driver' = 'rica6Hlm.dll'
Modifies file system
Creates the following files
- %TEMP%\7zs869e2e30\32_218_1464488429_1465864136.msi
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66ef.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set670f.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set672f.tmp
- <SYSTEM32>\set677e.tmp
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hgr.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66bf.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66ae.tmp
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rdj
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rcf
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.miz
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hur.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hci.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.psz
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.irj
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete545.tmp
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hch.chm
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set606c.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete798.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5ee1.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f6f.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f8f.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f9f.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6371.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set668e.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6517.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set60bc.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set61b7.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6244.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set62f1.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6321.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6360.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5fc0.tmp
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set608c.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete69d.tmp
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcf.cfz
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hct.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_norwegian.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_polish.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_portuguese.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_russian.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_simplifiedchinese.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_spanish.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_italian.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_korean.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_swedish.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\jobhook.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\outputimage.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\popup.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\printercopyguardpreview.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\printerpreventioncopypatternpreview.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\watermark.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_traditionalchinese.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_turkish.chm
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcz.dlz
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcl.ini
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_german.chm
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcb.dll
- <SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll
- <SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll
- <SYSTEM32>\spool\drivers\x64\3\new\rd06hd64.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\borderline.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_greek.chm
- <SYSTEM32>\spool\drivers\x64\3\new\rica6hcj.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_hungarian.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\colorbalance.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_danish.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_dutch.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_english.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_finnish.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_french.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_brazilian.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_catalan.chm
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_czech.chm
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete38f.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete1f8.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdfc6.tmp
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hch.chm
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hci.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcj.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcl.ini
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hct.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcz.dlz
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\mfricr64.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hur.dl_
- %ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\difxapi.dll
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hug.miz
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\oemsetup.inf
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.irj
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.rcf
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.rdj
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hlm.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hgr.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hug.dl_
- %ALLUSERSPROFILE%\ricoh\rpicheck.ini
- %ALLUSERSPROFILE%\ricoh\pdplog\ibyhoadx_10262020_153835.riusrswitcher.log
- %TEMP%\7zs869e2e30\32_218_1464488429.ini
- %TEMP%\7zs869e2e30\32_218_1464488429.7zcnf
- %TEMP%\7zs869e2e30\rp_tools_lng.irc
- %TEMP%\7zs869e2e30\1464488581.rcf
- %TEMP%\7zs869e2e30\pinst.exe
- %TEMP%\7zs869e2e30\riusrswitcher.exe
- %ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\rputil.exe
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\ricdb64.dl_
- %TEMP%\7zs869e2e30\pinst.bat
- %ALLUSERSPROFILE%\ricoh\pdplog\ibyhoadx_10262020_153837_pinst.log
- %ALLUSERSPROFILE%\ricoh\rp_tools_lng.irc
- %ALLUSERSPROFILE%\ricoh\pdpini\32_218_1464488429.ini
- %ALLUSERSPROFILE%\ricoh\pdpini\1464488581.rcf
- %ALLUSERSPROFILE%\ricoh\msilog\ibyhoadx_10262020_153837_msi.log
- %ALLUSERSPROFILE%\ricoh\pdplog\ibyhoadx_10262020_153843.rpicheck.log
- %ALLUSERSPROFILE%\ricoh\pdplog\operation.log
- %TEMP%\7zs869e2e30\libeay32.dll
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\oemsetup.dsc
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rd06hd64.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc4b7.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc871.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc98a.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcb50.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcca8.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setce9c.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc37e.tmp
- %ALLUSERSPROFILE%\ricoh\pdplog\ibyhoadx_10262020_153845.rputil.log
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc6f9.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcfe5.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd7e4.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd8fe.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdae3.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdca8.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setde4e.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd1ba.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd3ae.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd5d1.tmp
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc245.tmp
- %ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\1464488581.rcf
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\readme.html
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcb.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcd.dl_
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcd.psz
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcf.cfz
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\actiondata.chk
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\actiondata.psd
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\innerdata.chk
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6h.cat
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\innerdata.psd
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd.chk
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd.psd
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_0.ssd
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_1.ssd
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_2.ssd
- %ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\irc\rp_tools_lng.irc
- %ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\32_218_1464488429.ini
- %ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\modelssdlist.msl
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\watermarkpreview.dll
- %ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\cfz_index.dat
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\mfricr64.dl_
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\mfricr64.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rd06hd64.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcb.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcd.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcd.psz
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcf.cfz
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hch.chm
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hci.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcj.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcl.ini
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hct.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcz.dlz
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hgr.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hug.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hug.miz
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.dll
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.irj
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.rcf
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.rdj
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\ricdb64.dl_
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hur.dll
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hur.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.rcf
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\oemsetup.inf
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rd06hd64.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6h.cat
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcb.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcd.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcd.psz
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcf.cfz
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hch.chm
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hci.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcj.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcl.ini
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hct.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcz.dlz
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hgr.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hlm.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hug.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hug.miz
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.dl_
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.irj
- %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.rdj
- <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\ricdb64.dll
Moves the following files
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc245.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\mfricr64.dl_
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6321.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcf.cfz
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6360.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcl.ini
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6371.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hch.chm
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6517.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcz.dlz
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set668e.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcj.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66ae.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hct.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66bf.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcb.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set66ef.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\ricdb64.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set670f.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\mfricr64.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set672f.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rd06hd64.dll
- from <SYSTEM32>\set677e.tmp to <SYSTEM32>\rica6hlm.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hgr.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hgr.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hui.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.psz to <SYSTEM32>\spool\drivers\x64\3\rica6hcd.psz
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.irj to <SYSTEM32>\spool\drivers\x64\3\rica6hui.irj
- from <SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll to <SYSTEM32>\spool\drivers\x64\3\mfricr64.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rdj to <SYSTEM32>\spool\drivers\x64\3\rica6hui.rdj
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rcf to <SYSTEM32>\spool\drivers\x64\3\rica6hui.rcf
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hug.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.miz to <SYSTEM32>\spool\drivers\x64\3\rica6hug.miz
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hur.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hur.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hci.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hci.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcd.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcf.cfz to <SYSTEM32>\spool\drivers\x64\3\rica6hcf.cfz
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcl.ini to <SYSTEM32>\spool\drivers\x64\3\rica6hcl.ini
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcz.dlz to <SYSTEM32>\spool\drivers\x64\3\rica6hcz.dlz
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcj.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcj.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hct.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hct.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcb.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcb.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll to <SYSTEM32>\spool\drivers\x64\3\ricdb64.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set62f1.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcd.psz
- from <SYSTEM32>\spool\drivers\x64\3\new\rica6hch.chm to <SYSTEM32>\spool\drivers\x64\3\rica6hch.chm
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set6244.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hcd.dll
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdae3.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.rdj
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc37e.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcb.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc4b7.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcd.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc6f9.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hci.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc871.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcj.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setc98a.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hch.chm
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcb50.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hct.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcca8.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hgr.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setce9c.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hlm.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setcfe5.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hug.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd1ba.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcf.cfz
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd3ae.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd5d1.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcl.ini
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd7e4.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hur.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setd8fe.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.rcf
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdca8.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hui.irj
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set60bc.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hgr.dll
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setde4e.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcd.psz
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\setdfc6.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hcz.dlz
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete1f8.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6hug.miz
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete38f.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\oemsetup.inf
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete545.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rica6h.cat
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete69d.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\ricdb64.dl_
- from %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\sete798.tmp to %TEMP%\{2f1d1af6-a031-4268-43fc-da03a2c4e105}\rd06hd64.dl_
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5ee1.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f6f.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.irj
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f8f.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.rdj
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5f9f.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hui.rcf
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set5fc0.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hug.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set606c.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hug.miz
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set608c.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hur.dll
- from <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\set61b7.tmp to <SYSTEM32>\spool\drivers\x64\{d67a8773-70d5-41b9-aa46-7fc807e38a01}\rica6hci.dll
- from <SYSTEM32>\spool\drivers\x64\3\new\rd06hd64.dll to <SYSTEM32>\spool\drivers\x64\3\rd06hd64.dll
Miscellaneous
Creates and executes the following
- '%TEMP%\7zs869e2e30\riusrswitcher.exe' /C "PINST.exe" /H /A x64
- '%TEMP%\7zs869e2e30\pinst.exe'
- '%ProgramFiles(x86)%\ricoh\queue\{49651021-c082-4a80-9f12-922f20425643}_32_218_1464488429\rputil.exe' -i -e -f 32_218_1464488429.ini
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS869E2E30\PINST.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS869E2E30\PINST.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS869E2E30\PINST.exe"
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS869E2E30\PINST.bat"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" VER "
- '%WINDIR%\syswow64\find.exe' "XP"
- '%WINDIR%\syswow64\icacls.exe' "%ALLUSERSPROFILE%\RICOH\PDPLOG\Operation.log" /grant everyone:F
- '%WINDIR%\syswow64\msiexec.exe' /i 32_218_1464488429_1465864136.msi /norestart /passive /l*vx+ "%ALLUSERSPROFILE%\RICOH\msilog\ibyhoadx_10262020_153837_msi.log"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{ce5fdd85-2c28-4c98-b420-99a93e5e449c} "(null)"
