Trojan.Siggen19.47137

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\System\CurrentControlSet\Control\Print\Monitors\rica5Jlm] 'Driver' = 'rica5Jlm.dll'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zscf6aa9cc\5_29_1595560658_1595561097.msi
<SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\3\new\mpc82d64.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\borderline.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_brazilian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_catalan.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_czech.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_danish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_dutch.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_english.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_finnish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_french.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_german.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_greek.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_hungarian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_italian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_norwegian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_polish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_portuguese.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_russian.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_simplifiedchinese.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcb.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_spanish.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica5jct.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcz.dlz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc7ef.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc800.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc820.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc840.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc860.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc880.tmp
<SYSTEM32>\setc8b0.tmp
<SYSTEM32>\spool\drivers\x64\3\new\rica5jgr.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcd.psz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jch.chm
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.irj
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.rdj
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.rcf
<SYSTEM32>\spool\drivers\x64\3\new\rica5jug.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jug.miz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jur.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jci.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcd.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcf.cfz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcl.ini
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcj.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\stream_filter.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\10.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_turkish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\wording\aficio mp c3002\index.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\12.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\12_lists.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\22.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\32.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\7.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\30.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\5.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\4.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\16.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\16_lists.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\29.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\28.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\17.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\13.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\13_lists.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\25.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\25_lists.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\26.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\27.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\8v6zly\filecache_drvdevicecapabilites\31.dat
<SYSTEM32>\ricdb.ini
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc742.tmp
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\current_jobcode.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\paper\standard.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\jobhook.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\outputimage.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\popup.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\printercopyguardpreview.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\printerpreventioncopypatternpreview.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\watermark.dll
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\watermarkpreview.dll
%TEMP%\dmie7ee.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_2ef45a919b82644beac827e74d707c9dd1bb1e_cab_0a91ec03\dmie7ee.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_2ef45a919b82644beac827e74d707c9dd1bb1e_cab_0a91ec03\oem2.inf
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_2ef45a919b82644beac827e74d707c9dd1bb1e_cab_0a91ec03\report.wer
%TEMP%\dmif122.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_c8db1e7f85fb912f622ec5bd8eca18e1b1f761d_cab_0a91f21b\dmif122.tmp.log.xml
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_c8db1e7f85fb912f622ec5bd8eca18e1b1f761d_cab_0a91f21b\oem2.inf
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_c8db1e7f85fb912f622ec5bd8eca18e1b1f761d_cab_0a91f21b\report.wer
%ALLUSERSPROFILE%\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\cfz_index.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\wording\aficio mp c3002\english\wordings.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\wording\aficio mp c3002\english\wordings_wc.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\paper\paper.dat
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_swedish.chm
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\dlz\help\rica5jui_traditionalchinese.chm
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc722.tmp
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\innerdata.chk
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jct.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcz.dlz
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jgr.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jlm.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jug.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jug.miz
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\oemsetup.dsc
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jui.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jui.irj
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jui.rcf
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jui.rdj
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jur.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\ricdb64.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\oemsetup.inf
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\readme.html
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5j.cat
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcb.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcd.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcd.psz
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcf.cfz
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\actiondata.chk
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcl.ini
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\actiondata.psd
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jcj.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jch.chm
%TEMP%\7zscf6aa9cc\pinst.bat
%TEMP%\7zscf6aa9cc\5_29_1595560658.ini
%TEMP%\7zscf6aa9cc\message.ini
%TEMP%\7zscf6aa9cc\5_29_1595560658.7zcnf
%TEMP%\7zscf6aa9cc\rp_tools_lng.irc
%TEMP%\7zscf6aa9cc\1589338302.rcf
%TEMP%\7zscf6aa9cc\pinst.exe
%TEMP%\7zscf6aa9cc\riusrswitcher.exe
%TEMP%\7zscf6aa9cc\libeay32.dll
%ALLUSERSPROFILE%\ricoh\pdplog\operation.log
%ALLUSERSPROFILE%\ricoh\pdplog\qyrxqxm_02112023_232015.riusrswitcher.log
%ALLUSERSPROFILE%\ricoh\msilog\qyrxqxm_02112023_232020_pdp_installer.log
%ALLUSERSPROFILE%\ricoh\rp_tools_lng.irc
%ALLUSERSPROFILE%\ricoh\pdpini\5_29_1595560658.ini
%ALLUSERSPROFILE%\ricoh\pdpini\1589338302.rcf
%ALLUSERSPROFILE%\ricoh\pdplog\qyrxqxm_02112023_232024.rpicheck.log
%ALLUSERSPROFILE%\ricoh\rpicheck.ini
%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\rputil.exe
%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\difxapi.dll
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\mfricr64.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\mpc82d64.dl_
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\rica5jci.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6016.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc6e2.tmp
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\innerdata.psd
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set62a8.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set63b2.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set649d.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6569.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set66b1.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set67ac.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set68a7.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set69a1.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6a7d.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc4e4.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc523.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc543.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc554.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc574.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc5e2.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc602.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc623.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc662.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc692.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc6c2.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set61ad.tmp
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc702.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6101.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5f1b.tmp
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\modelssdlist.msl
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd.chk
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd.psd
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd_0.ssd
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd_1.ssd
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd_2.ssd
%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\irc\rp_tools_lng.irc
%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\5_29_1595560658.ini
%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\1589338302.rcf
%ALLUSERSPROFILE%\ricoh\pdplog\qyrxqxm_02112023_232026.rputil.log
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set558e.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set565a.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5736.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5821.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set58fc.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5989.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5a94.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5b40.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5c4a.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5cf7.tmp
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5e11.tmp
%ProgramFiles(x86)%\ricoh\printer\1595560653_12-22-2015\disk1\psz\rica5jcd_3.ssd
%ALLUSERSPROFILE%\ricoh\pdplog\qyrxqxm_02112023_232121.rpicheck.log

Присваивает атрибут 'скрытый' для следующих файлов

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Удаляет следующие файлы

%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\mfricr64.dl_
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcd.psz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcf.cfz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jch.chm
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jci.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcj.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcl.ini
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jct.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcz.dlz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jgr.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jug.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jug.miz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.irj
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.rcf
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.rdj
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jur.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\ricdb64.dll
%TEMP%\dmie7ee.tmp.log.xml
%TEMP%\dmif122.tmp.log.xml
%ALLUSERSPROFILE%\rpdinstv.ini
%ALLUSERSPROFILE%\ricoh_drv\ricoh aficio mp c3002 pcl 6\_common\current_jobcode.dat
%TEMP%\7zscf6aa9cc\5_29_1595560658_1595561097.msi
%ALLUSERSPROFILE%\ricoh\pdpini\1589338302.rcf
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcd.dll
%ALLUSERSPROFILE%\ricoh\pdpini\5_29_1595560658.ini
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcb.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\mfricr64.dll
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\mpc82d64.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\oemsetup.inf
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5j.cat
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcb.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcd.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcd.psz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcf.cfz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jch.chm
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jci.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcj.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcl.ini
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jct.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcz.dlz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jgr.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jlm.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jug.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jug.miz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.irj
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.rcf
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.rdj
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jur.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\ricdb64.dl_
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\mpc82d64.dll
%ALLUSERSPROFILE%\ricoh\rp_tools_lng.irc

Перемещает следующие файлы

%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set558e.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\mfricr64.dl_
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc6e2.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcf.cfz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc702.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcl.ini
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc722.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jch.chm
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc742.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcz.dlz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc7ef.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcj.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc800.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jct.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc820.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcb.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc840.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc860.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc880.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\mpc82d64.dll
<SYSTEM32>\setc8b0.tmp в <SYSTEM32>\rica5jlm.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jgr.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jgr.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jui.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcd.psz в <SYSTEM32>\spool\drivers\x64\3\rica5jcd.psz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.irj в <SYSTEM32>\spool\drivers\x64\3\rica5jui.irj
<SYSTEM32>\spool\drivers\x64\3\new\mfricr64.dll в <SYSTEM32>\spool\drivers\x64\3\mfricr64.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.rdj в <SYSTEM32>\spool\drivers\x64\3\rica5jui.rdj
<SYSTEM32>\spool\drivers\x64\3\new\rica5jui.rcf в <SYSTEM32>\spool\drivers\x64\3\rica5jui.rcf
<SYSTEM32>\spool\drivers\x64\3\new\rica5jug.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jug.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jug.miz в <SYSTEM32>\spool\drivers\x64\3\rica5jug.miz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jur.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jur.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jci.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jci.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcd.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jcd.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcf.cfz в <SYSTEM32>\spool\drivers\x64\3\rica5jcf.cfz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcl.ini в <SYSTEM32>\spool\drivers\x64\3\rica5jcl.ini
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcz.dlz в <SYSTEM32>\spool\drivers\x64\3\rica5jcz.dlz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcj.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jcj.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jct.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jct.dll
<SYSTEM32>\spool\drivers\x64\3\new\rica5jcb.dll в <SYSTEM32>\spool\drivers\x64\3\rica5jcb.dll
<SYSTEM32>\spool\drivers\x64\3\new\ricdb64.dll в <SYSTEM32>\spool\drivers\x64\3\ricdb64.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc6c2.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcd.psz
<SYSTEM32>\spool\drivers\x64\3\new\rica5jch.chm в <SYSTEM32>\spool\drivers\x64\3\rica5jch.chm
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc692.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jcd.dll
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set62a8.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.rdj
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set565a.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcb.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5736.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcd.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5821.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jci.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set58fc.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcj.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5989.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jch.chm
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5a94.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jct.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5b40.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jgr.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5c4a.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jlm.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5cf7.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jug.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5e11.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcf.cfz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set5f1b.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6016.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcl.ini
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6101.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jur.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set61ad.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.rcf
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set63b2.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jui.irj
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc623.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jgr.dll
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set649d.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcd.psz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6569.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jcz.dlz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set66b1.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5jug.miz
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set67ac.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\oemsetup.inf
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set68a7.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\rica5j.cat
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set69a1.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\ricdb64.dl_
%TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\set6a7d.tmp в %TEMP%\{439e1d7f-eccc-3ee1-7117-415de2300310}\mpc82d64.dl_
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc4e4.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc523.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.irj
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc543.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.rdj
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc554.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jui.rcf
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc574.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jug.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc5e2.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jug.miz
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc602.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jur.dll
<SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\setc662.tmp в <SYSTEM32>\spool\drivers\x64\{626f5aa0-f059-46e5-8bee-8bcce7fe660d}\rica5jci.dll
<SYSTEM32>\spool\drivers\x64\3\new\mpc82d64.dll в <SYSTEM32>\spool\drivers\x64\3\mpc82d64.dll

Изменяет следующие файлы

Сетевая активность

UDP

'<LOCALNET>.5.248':161

Другое

Создает и запускает на исполнение

'%TEMP%\7zscf6aa9cc\riusrswitcher.exe' /C "PINST.exe" /H /A x64
'%TEMP%\7zscf6aa9cc\pinst.exe'
'%ProgramFiles(x86)%\ricoh\queue\{4312fc8c-1357-425f-b1dc-cb938b4fe95b}_5_29_1595560658\rputil.exe' -i -e -f 5_29_1595560658.ini -p
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zSCF6AA9CC\PINST.exe"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zSCF6AA9CC\PINST.bat"' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zSCF6AA9CC\PINST.exe"
'%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\7zSCF6AA9CC\PINST.bat"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" VER "
'%WINDIR%\syswow64\find.exe' "XP"
'%WINDIR%\syswow64\icacls.exe' "%ALLUSERSPROFILE%\RICOH\PDPLOG\Operation.log" /grant everyone:F
'%WINDIR%\syswow64\msiexec.exe' /i 5_29_1595560658_1595561097.msi /norestart /passive /l*vx+ "%ALLUSERSPROFILE%\RICOH\msilog\qyrxqxm_02112023_232020_pdp_installer.log"
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{5884cabe-832c-48e8-84fb-ae6a9c44955c} "(null)"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней