Trojan.Siggen10.42476

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\rica6Hlm] 'Driver' = 'rica6Hlm.dll'

Modifies file system

Creates the following files

%TEMP%\7zs0cb1f5e1\14_92_1464488429_1465780958.msi
<SYSTEM32>\spool\drivers\x64\3\new\rica6hci.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcf.cfz
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcl.ini
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcz.dlz
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcj.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hug.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hct.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hur.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\3\new\rd06hd64.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\borderline.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\colorbalance.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_brazilian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_catalan.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_czech.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcb.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_danish.chm
<SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hug.miz
<SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rcf
<SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rdj
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9fd0.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta05e.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta07e.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0ae.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0be.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0df.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta1f8.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f32.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta219.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta249.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta26a.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta27a.tmp
<SYSTEM32>\seta2ba.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rica6hgr.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hui.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.psz
<SYSTEM32>\spool\drivers\x64\3\new\rica6hch.chm
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta239.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rica6hui.irj
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f22.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f91.tmp
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_dutch.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_german.chm
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_1a3269dabaa1a4604533ba443b33f63f7eb94a_cab_084ad558\dmid317.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_1a3269dabaa1a4604533ba443b33f63f7eb94a_cab_084ad558\oem2.inf
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_1a3269dabaa1a4604533ba443b33f63f7eb94a_cab_084ad558\report.wer
%TEMP%\dmid96e.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_e9b233fe8d3ec7e99dc45deca163291cd4bcbaf_cab_084adef9\dmid96e.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_e9b233fe8d3ec7e99dc45deca163291cd4bcbaf_cab_084adef9\oem2.inf
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_e9b233fe8d3ec7e99dc45deca163291cd4bcbaf_cab_084adef9\report.wer
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\cfz_index.dat
%TEMP%\dmid317.tmp.log.xml
%ALLUSERSPROFILE%\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\wording\mp c3503\english\wordings_wc.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\paper\paper.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\paper\standard.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\stream_filter.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\current_jobcode.dat
<SYSTEM32>\ricdb.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\wording\mp c3503\index.dat
%ALLUSERSPROFILE%\ricoh\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\wording\mp c3503\english\wordings.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\watermarkpreview.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\printerpreventioncopypatternpreview.dll
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set20ee.tmp
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_greek.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_hungarian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_italian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_korean.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_norwegian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_polish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_portuguese.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_russian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_simplifiedchinese.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_spanish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_swedish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_traditionalchinese.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_turkish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\jobhook.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\outputimage.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\popup.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\printercopyguardpreview.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_english.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_french.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\help\rica6hui_finnish.chm
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9e85.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9de8.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d89.tmp
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hct.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcz.dlz
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hgr.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hlm.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hug.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hug.miz
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hci.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\oemsetup.inf
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcl.ini
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.irj
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.rdj
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hur.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\ricdb64.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rd06hd64.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\readme.html
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6h.cat
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hch.chm
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hui.rcf
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\oemsetup.dsc
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\mfricr64.dl_
%TEMP%\7zs0cb1f5e1\pinst.bat
%TEMP%\7zs0cb1f5e1\14_92_1464488429.7zcnf
%TEMP%\7zs0cb1f5e1\rp_tools_lng.irc
%TEMP%\7zs0cb1f5e1\1464488581.rcf
%TEMP%\7zs0cb1f5e1\pinst.exe
%TEMP%\7zs0cb1f5e1\riusrswitcher.exe
%TEMP%\7zs0cb1f5e1\libeay32.dll
%ALLUSERSPROFILE%\ricoh\pdplog\operation.log
%ALLUSERSPROFILE%\ricoh\pdplog\ulskdnnamrh_10262020_191446.riusrswitcher.log
%TEMP%\7zs0cb1f5e1\14_92_1464488429.ini
%ALLUSERSPROFILE%\ricoh\pdplog\ulskdnnamrh_10262020_191447_pinst.log
%ALLUSERSPROFILE%\ricoh\pdpini\14_92_1464488429.ini
%ALLUSERSPROFILE%\ricoh\pdpini\1464488581.rcf
%ALLUSERSPROFILE%\ricoh\msilog\ulskdnnamrh_10262020_191447_msi.log
%ALLUSERSPROFILE%\ricoh\pdplog\ulskdnnamrh_10262020_191450.rpicheck.log
%ALLUSERSPROFILE%\ricoh\rpicheck.ini
%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\rputil.exe
%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\difxapi.dll
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcb.dl_
%ALLUSERSPROFILE%\ricoh\rp_tools_lng.irc
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcd.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcj.dl_
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcd.psz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set240d.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set26ad.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set27b8.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2900.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set29dc.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2b34.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2c9c.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2de4.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2efe.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set31ad.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3612.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set371c.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3816.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3940.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9ccb.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d68.tmp
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d79.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2302.tmp
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\rica6hcf.cfz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2584.tmp
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\dlz\watermark.dll
%ALLUSERSPROFILE%\ricoh\pdplog\printername.csv
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1f77.tmp
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\actiondata.psd
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\innerdata.chk
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\innerdata.psd
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\modelssdlist.msl
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd.chk
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd.psd
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_0.ssd
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_1.ssd
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\actiondata.chk
%ProgramFiles(x86)%\ricoh\printer\1464488420_03-09-2016\disk1\psz\rica6hcd_2.ssd
%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\14_92_1464488429.ini
%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\1464488581.rcf
%ALLUSERSPROFILE%\ricoh\pdplog\ulskdnnamrh_10262020_191453.rputil.log
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1ad0.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1b7d.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1c29.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1da1.tmp
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1e9b.tmp
%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\irc\rp_tools_lng.irc
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set21d9.tmp
%ALLUSERSPROFILE%\ricoh\pdplog\ulskdnnamrh_10262020_191602.rpicheck.log

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Deletes the following files

%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\mfricr64.dl_
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcj.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcl.ini
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hct.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcz.dlz
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hgr.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hug.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hug.miz
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.irj
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.rcf
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.rdj
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hur.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\ricdb64.dll
%TEMP%\dmid317.tmp.log.xml
%TEMP%\dmid96e.tmp.log.xml
%ALLUSERSPROFILE%\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh mp c3503 pcl 6\_common\current_jobcode.dat
%TEMP%\7zs0cb1f5e1\14_92_1464488429_1465780958.msi
%ALLUSERSPROFILE%\ricoh\pdpini\1464488581.rcf
%ALLUSERSPROFILE%\ricoh\pdpini\14_92_1464488429.ini
%ALLUSERSPROFILE%\ricoh\rp_tools_lng.irc
%TEMP%\7zs0cb1f5e1\1464488581.rcf
%TEMP%\7zs0cb1f5e1\14_92_1464488429.7zcnf
%TEMP%\7zs0cb1f5e1\14_92_1464488429.ini
%TEMP%\7zs0cb1f5e1\libeay32.dll
%TEMP%\7zs0cb1f5e1\pinst.bat
%TEMP%\7zs0cb1f5e1\pinst.exe
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hci.dll
%TEMP%\7zs0cb1f5e1\riusrswitcher.exe
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hch.chm
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcd.psz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\oemsetup.inf
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rd06hd64.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6h.cat
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcb.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcd.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcd.psz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcf.cfz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hch.chm
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hci.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcj.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcl.ini
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hct.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcz.dlz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hgr.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hlm.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hug.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hug.miz
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.irj
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.rcf
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.rdj
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hur.dl_
%TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\ricdb64.dl_
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rd06hd64.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcb.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcd.dll
<SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcf.cfz
%TEMP%\7zs0cb1f5e1\rp_tools_lng.irc

Moves the following files

from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1ad0.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\mfricr64.dl_
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta07e.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcf.cfz
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0ae.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcl.ini
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0be.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hch.chm
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta0df.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcz.dlz
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta1f8.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcj.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta219.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hct.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta239.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcb.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta249.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta26a.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta27a.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rd06hd64.dll
from <SYSTEM32>\seta2ba.tmp to <SYSTEM32>\rica6hlm.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hgr.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hgr.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hui.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.psz to <SYSTEM32>\spool\drivers\x64\3\rica6hcd.psz
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.irj to <SYSTEM32>\spool\drivers\x64\3\rica6hui.irj
from <SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll to <SYSTEM32>\spool\drivers\x64\3\mfricr64.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rdj to <SYSTEM32>\spool\drivers\x64\3\rica6hui.rdj
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hui.rcf to <SYSTEM32>\spool\drivers\x64\3\rica6hui.rcf
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hug.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hug.miz to <SYSTEM32>\spool\drivers\x64\3\rica6hug.miz
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hur.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hur.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hci.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hci.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcd.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcd.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcf.cfz to <SYSTEM32>\spool\drivers\x64\3\rica6hcf.cfz
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcl.ini to <SYSTEM32>\spool\drivers\x64\3\rica6hcl.ini
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcz.dlz to <SYSTEM32>\spool\drivers\x64\3\rica6hcz.dlz
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcj.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcj.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hct.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hct.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hcb.dll to <SYSTEM32>\spool\drivers\x64\3\rica6hcb.dll
from <SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll to <SYSTEM32>\spool\drivers\x64\3\ricdb64.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\seta05e.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcd.psz
from <SYSTEM32>\spool\drivers\x64\3\new\rica6hch.chm to <SYSTEM32>\spool\drivers\x64\3\rica6hch.chm
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9fd0.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hcd.dll
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2b34.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.rdj
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1b7d.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcb.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1c29.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcd.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1da1.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hci.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1e9b.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcj.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set1f77.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hch.chm
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set20ee.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hct.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set21d9.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hgr.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2302.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hlm.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set240d.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hug.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2584.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcf.cfz
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set26ad.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set27b8.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcl.ini
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2900.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hur.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set29dc.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.rcf
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2c9c.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hui.irj
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f32.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hgr.dll
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2de4.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcd.psz
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set2efe.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hcz.dlz
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set31ad.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6hug.miz
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3612.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\oemsetup.inf
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set371c.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rica6h.cat
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3816.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\ricdb64.dl_
from %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\set3940.tmp to %TEMP%\{34bac26e-4972-13d2-349c-857ab420ac38}\rd06hd64.dl_
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9ccb.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d68.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.irj
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d79.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.rdj
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9d89.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hui.rcf
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9de8.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hug.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9e85.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hug.miz
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f22.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hur.dll
from <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\set9f91.tmp to <SYSTEM32>\spool\drivers\x64\{c24d2521-a6b0-4432-a6b0-4fa99c479691}\rica6hci.dll
from <SYSTEM32>\spool\drivers\x64\3\new\rd06hd64.dll to <SYSTEM32>\spool\drivers\x64\3\rd06hd64.dll

Network activity

UDP

'10.#0.3.36':161

Miscellaneous

Creates and executes the following

'%TEMP%\7zs0cb1f5e1\riusrswitcher.exe' /C "PINST.exe" /H /A x64
'%TEMP%\7zs0cb1f5e1\pinst.exe'
'%ProgramFiles(x86)%\ricoh\queue\{b7c46fef-33eb-4c22-b021-2e8a7fd2fb3e}_14_92_1464488429\rputil.exe' -i -e -f 14_92_1464488429.ini
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS0CB1F5E1\PINST.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS0CB1F5E1\PINST.bat"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS0CB1F5E1\PINST.exe"
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zS0CB1F5E1\PINST.bat"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" VER "
'%WINDIR%\syswow64\find.exe' "XP"
'%WINDIR%\syswow64\icacls.exe' "%ALLUSERSPROFILE%\RICOH\PDPLOG\Operation.log" /grant everyone:F
'%WINDIR%\syswow64\msiexec.exe' /i 14_92_1464488429_1465780958.msi /norestart /passive /l*vx+ "%ALLUSERSPROFILE%\RICOH\msilog\ulskdnnamrh_10262020_191447_msi.log"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{f246704d-bd69-4031-96a7-58199ec34b9b} "(null)"

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial