Trojan.DownLoader34.56064

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\ricu0klm] 'Driver' = 'ricu0klm.dll'

Modifies file system

Creates the following files

%TEMP%\myprintippinstaller\64bit\copcl6ud.txt
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5c55.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5bf7.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5bd7.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5ba7.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a9d.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a7c.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a6c.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5904.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5848.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set554a.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set54dc.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set54bc.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set541f.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set53ff.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set53df.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52f4.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52d3.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52a4.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5283.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set51b8.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd5df.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd513.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd35d.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5ce3.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5d23.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rd01kd64.dll
<SYSTEM32>\set5dc0.tmp
<SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0ktl.exe
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcb.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kct.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcj.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcz.dlz
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcl.ini
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcf.cfz
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcd.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kci.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kgl.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kur.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kug.miz
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kug.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.rcf
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.rdj
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.irj
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kch.chm
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kcd.psz
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricu0kgr.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5de0.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd188.tmp
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5d03.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd030.tmp
%TEMP%\myprintippinstaller\64bit\ricu0kui.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kug.dl_
%TEMP%\myprintippinstaller\64bit\ricu0ktl.ex_
%TEMP%\myprintippinstaller\64bit\ricu0klm.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kgr.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kgl.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kcz.dlz
%TEMP%\myprintippinstaller\64bit\ricu0kct.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kcl.ini
%TEMP%\myprintippinstaller\64bit\ricu0kcj.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kci.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kch.chm
%TEMP%\myprintippinstaller\64bit\ricu0kcf.cfz
%TEMP%\myprintippinstaller\64bit\ricu0kce.eij
%TEMP%\myprintippinstaller\64bit\ricu0kcd.psz
%TEMP%\myprintippinstaller\64bit\ricu0kcd.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kcb.dl_
%TEMP%\myprintippinstaller\64bit\ricu0k.cat
%TEMP%\myprintippinstaller\64bit\ricdb64.dl_
%TEMP%\myprintippinstaller\64bit\readme.html
%TEMP%\myprintippinstaller\64bit\rd01kd64.dl_
%TEMP%\myprintippinstaller\64bit\oemsetup.inf
%TEMP%\myprintippinstaller\64bit\oemsetup.dsc
%TEMP%\myprintippinstaller\64bit\mfricr64.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kug.miz
%TEMP%\myprintippinstaller\64bit\ricu0kui.irj
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setccc5.tmp
%TEMP%\myprintippinstaller\64bit\ricu0kui.rcf
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setcb4d.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setca43.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc939.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc800.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc698.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc57e.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc36b.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbf83.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbdfc.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbc75.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbbc9.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setba71.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb9d4.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb8ba.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb790.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb648.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb51e.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb369.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb25e.tmp
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb106.tmp
%TEMP%\myprintippinstaller\installprinter_x64.bat
%TEMP%\myprintippinstaller\64bit\ricu0kur.dl_
%TEMP%\myprintippinstaller\64bit\ricu0kui.rdj
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setced8.tmp
<SYSTEM32>\spool\drivers\x64\3\new\copcl6ud.txt

Deletes the following files

%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\copcl6ud.txt
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\copcl6ud.txt
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\rd01kd64.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcb.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcd.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcd.psz
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcf.cfz
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kch.chm
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kci.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcl.ini
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.rdj
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kct.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcz.dlz
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kgl.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kgr.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0ktl.exe
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kug.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kug.miz
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.dll
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.irj
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.rcf
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kur.dl_
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcj.dll
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.rdj
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kci.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\mfricr64.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\oemsetup.inf
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\rd01kd64.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricdb64.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0k.cat
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcb.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcd.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcd.psz
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcf.cfz
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kch.chm
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcj.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.irj
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcl.ini
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kct.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcz.dlz
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kgl.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kgr.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0klm.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0ktl.ex_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kug.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kug.miz
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.dl_
%TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.rcf
<SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kur.dll

Moves the following files

from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb106.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\mfricr64.dl_
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kch.chm to <SYSTEM32>\spool\drivers\x64\3\ricu0kch.chm
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcd.psz to <SYSTEM32>\spool\drivers\x64\3\ricu0kcd.psz
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kui.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kgr.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kgr.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5de0.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\copcl6ud.txt
from <SYSTEM32>\set5dc0.tmp to <SYSTEM32>\ricu0klm.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5d23.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\rd01kd64.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5d03.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5ce3.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5c55.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0ktl.exe
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5bf7.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcb.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5bd7.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kct.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5ba7.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcj.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a9d.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcz.dlz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a7c.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kch.chm
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5904.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcf.cfz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5a6c.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcl.ini
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.irj to <SYSTEM32>\spool\drivers\x64\3\ricu0kui.irj
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.rdj to <SYSTEM32>\spool\drivers\x64\3\ricu0kui.rdj
from <SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll to <SYSTEM32>\spool\drivers\x64\3\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll to <SYSTEM32>\spool\drivers\x64\3\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0ktl.exe to <SYSTEM32>\spool\drivers\x64\3\ricu0ktl.exe
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcb.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kcb.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kct.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kct.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcj.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kcj.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcz.dlz to <SYSTEM32>\spool\drivers\x64\3\ricu0kcz.dlz
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcf.cfz to <SYSTEM32>\spool\drivers\x64\3\ricu0kcf.cfz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set51b8.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcd.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kcd.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kci.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kci.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kgl.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kgl.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kur.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kur.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kug.miz to <SYSTEM32>\spool\drivers\x64\3\ricu0kug.miz
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kug.dll to <SYSTEM32>\spool\drivers\x64\3\ricu0kug.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kui.rcf to <SYSTEM32>\spool\drivers\x64\3\ricu0kui.rcf
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5848.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcd.psz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set554a.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kcd.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set54dc.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kci.dll
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc57e.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kur.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc36b.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcl.ini
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbf83.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbdfc.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcf.cfz
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbc75.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kug.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setbbc9.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0klm.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setba71.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kgr.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb9d4.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kct.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb8ba.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kch.chm
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb790.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kgl.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb648.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcj.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb51e.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kci.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb369.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcd.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setb25e.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcb.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc800.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0ktl.ex_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc939.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.rdj
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setc698.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.rcf
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setca43.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kui.irj
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set54bc.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kgl.dll
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setcb4d.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcd.psz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set541f.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kgr.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set53ff.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kur.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set53df.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kug.miz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52f4.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kug.dll
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52d3.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.rcf
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set52a4.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.rdj
from <SYSTEM32>\spool\drivers\x64\3\new\ricu0kcl.ini to <SYSTEM32>\spool\drivers\x64\3\ricu0kcl.ini
from <SYSTEM32>\spool\drivers\x64\3\new\rd01kd64.dll to <SYSTEM32>\spool\drivers\x64\3\rd01kd64.dll
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd5df.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\rd01kd64.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd513.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricdb64.dl_
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd35d.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0k.cat
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd188.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\oemsetup.inf
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setd030.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\copcl6ud.txt
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setced8.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kug.miz
from %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\setccc5.tmp to %TEMP%\{1b8b0118-afb3-4f09-2812-58091dca7d2c}\ricu0kcz.dlz
from <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\set5283.tmp to <SYSTEM32>\spool\drivers\x64\{b36e53a7-edcd-4268-8515-8134c12c7df7}\ricu0kui.irj
from <SYSTEM32>\spool\drivers\x64\3\new\copcl6ud.txt to <SYSTEM32>\spool\drivers\x64\3\copcl6ud.txt

Network activity

TCP

'my####t.in-domus.it':443

UDP

DNS ASK my####t.in-domus.it

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\myPrintIPPInstaller\Installprinter_x64.bat" "
'%WINDIR%\syswow64\rundll32.exe' printui.dll,PrintUIEntry /if /b "myPrintIn-Domus" /f "%TEMP%\myPrintIPPInstaller/64bit/oemsetup.inf" /l "%TEMP%\myPrintIPPInstaller/64bit" /n "myPrintIn-Domus" /r "https://myprint.in-domus.it/R...

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial