Trojan.Siggen12.20483

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SYSTEM\CurrentControlSet\Control\Print\Monitors\Bullzip PDF Print Monitor] 'Driver' = '%CommonProgramFiles%\Bullzip\PDF Printer\Ports\BULLZIP\bzpdf.dll'

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=in action=allow enable=yes protocol=tcp program="<Текущая директория>\TabTabEnter.exe"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=in action=allow enable=yes protocol=udp program="<Текущая директория>\TabTabEnter.exe"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=out action=allow enable=yes protocol=tcp program="<Текущая директория>\TabTabEnter.exe"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=out action=allow enable=yes protocol=udp program="<Текущая директория>\TabTabEnter.exe"
'<SYSTEM32>\net.exe' STOP SPOOLER /Y

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\config.ini
%ProgramFiles%\bullzip\pdf printer\language\is-id8ic.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-47ia6.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-jgqlj.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-8e14n.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-n6aod.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-suphj.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-us6e3.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-suq1e.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-2rgd5.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-44mv5.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-kkkhd.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-09b9t.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-juudr.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-fv9v3.tmp
%ProgramFiles%\bullzip\pdf printer\debug\is-jrfre.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-emmep.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-619bo.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-e6l1l.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-14u9g.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-bnhr4.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-qdvc3.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-5gvr4.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-8goop.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-dgmsc.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-jki84.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-k7p3o.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-ao77t.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-6snqd.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-df1d5.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-klono.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-lq3kc.tmp
%ProgramFiles%\bullzip\pdf printer\is-p8pm4.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-jn01i.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-3tuvs.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-7av90.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-fhc9k.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-tg983.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-78d8m.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-b59kt.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-3s909.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bullzip\pdf printer\bullzip pdf printer options.lnk
%ProgramFiles%\bullzip\pdf printer\res\ico\16x16x32bpp\is-vnkrb.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bullzip\pdf printer\home page.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bullzip\pdf printer\documentation.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bullzip\pdf printer\debug\installation log.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\bullzip\pdf printer\debug\bug radar.lnk
%ProgramFiles%\bullzip\pdf printer\website.url
%ProgramFiles%\bullzip\pdf printer\doc.url
%ProgramFiles%\bullzip\pdf printer\language\is-mo30l.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-go6cm.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-jbsj0.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-akj08.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-9ft0v.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-okbav.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-g5vmj.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-4ntvv.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-1ccqa.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-icu0k.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-l9tio.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-jgd1d.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-3ucgp.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-obbc4.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-t9i9k.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-ptahp.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-53fcg.tmp
%WINDIR%\assembly\tmp\7kqlurpd\bullzip.pdfwriter.xpsinternal.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-4l3sb.tmp
%WINDIR%\assembly\tmp\w3gvssa9\bullzip.pdfwriter.internalext.dll
%WINDIR%\syswow64\is-he3kh.tmp
%WINDIR%\syswow64\is-9746a.tmp
%WINDIR%\syswow64\is-hv03a.tmp
%WINDIR%\syswow64\is-3mati.tmp
%WINDIR%\syswow64\is-e9rsm.tmp
%WINDIR%\syswow64\is-kf4fo.tmp
%WINDIR%\syswow64\is-r6dak.tmp
%ProgramFiles%\bullzip\pdf printer\is-1ep58.tmp
%TEMP%\is-g9k8d.tmp\isxdl.dll
%TEMP%\is-g9k8d.tmp\_isetup\_setup64.tmp
%TEMP%\setup log 2021-03-02 #001.txt
%TEMP%\is-jo2so.tmp\setup_bullzippdfprinter.tmp
<Текущая директория>\bullzip\bullzipinstallscript.bat
%CommonProgramFiles%\bullzip\pdf printer\ports\bullzip\is-soelg.tmp
<Текущая директория>\bullzip\setup_bullzippdfprinter.exe
<Текущая директория>\bullzip.7z
<Текущая директория>\7za.exe
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kfdsbt5u\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\8ww6ya3a\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\828ti2hj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6lgqkg9p\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
<Текущая директория>\log.txt
%TEMP%\7zx.bat
%ProgramFiles%\bullzip\pdf printer\is-ejdc5.tmp
%WINDIR%\syswow64\is-sfvnq.tmp
%ProgramFiles%\bullzip\pdf printer\is-knj8m.tmp
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-nu1nc.tmp
%CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v2.0\is-5cvej.tmp
%WINDIR%\assembly\tmp\qbo0bfdv\bullzip.pdfwriter.internalext.dll
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-an8mk.tmp
%WINDIR%\assembly\tmp\ft5m3gl3\bullzip.pdfwriter.upload.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-2729o.tmp
%WINDIR%\assembly\tmp\ny40131s\bullzip.pdfwriter.upload.dll
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-8cib0.tmp
%WINDIR%\assembly\tmp\wc6ce4jo\bullzip.pdfwriter.lib.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-fc46t.tmp
%WINDIR%\assembly\tmp\bjl0sj0o\bullzip.pdfwriter.lib.dll
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-asfgo.tmp
%ProgramFiles%\bullzip\pdf printer\is-h6cji.tmp
%WINDIR%\assembly\tmp\lbkkt6up\bullzip.pdfwriter.dll
%CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v4.0\is-o6h2c.tmp
%WINDIR%\assembly\tmp\ybxouej7\bullzip.pdfwriter.dll
%ProgramFiles%\bullzip\pdf printer\icc\is-775vm.tmp
%ProgramFiles%\bullzip\pdf printer\is-vimfm.tmp
%WINDIR%\syswow64\is-3gob5.tmp
%WINDIR%\syswow64\is-oppvm.tmp
%ProgramFiles%\bullzip\pdf printer\is-e13ql.tmp
%ProgramFiles%\bullzip\pdf printer\is-6iqim.tmp
%ProgramFiles%\bullzip\pdf printer\is-0id6o.tmp
%ProgramFiles%\bullzip\pdf printer\is-ia6k7.tmp
%ProgramFiles%\bullzip\pdf printer\language\is-t650d.tmp
%ProgramFiles%\bullzip\pdf printer\macros\examples\is-2jcd1.tmp
<SYSTEM32>\spool\drivers\x64\3\is-9230k.tmp
<SYSTEM32>\spool\drivers\w32x86\3\is-icq56.tmp
<SYSTEM32>\spool\drivers\w32x86\0\is-d2b4u.tmp
%ProgramFiles%\bullzip\pdf printer\api\exe\is-1655u.tmp
%ProgramFiles%\bullzip\pdf printer\api\com\is-bnjn0.tmp
%CommonProgramFiles%\bullzip\pdf printer\api\com\is-kpbbs.tmp
%ProgramFiles%\bullzip\pdf printer\prodinfo.url
%ProgramFiles%\bullzip\pdf printer\distiller.ini

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6lgqkg9p\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\828ti2hj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\8ww6ya3a\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\kfdsbt5u\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Удаляет следующие файлы

%TEMP%\7zx.bat
<Текущая директория>\bullzip.7z

Перемещает следующие файлы

%ProgramFiles%\bullzip\pdf printer\is-1ep58.tmp в %ProgramFiles%\bullzip\pdf printer\unins000.exe
%ProgramFiles%\bullzip\pdf printer\language\is-jn01i.tmp в %ProgramFiles%\bullzip\pdf printer\language\kor.txt
%ProgramFiles%\bullzip\pdf printer\language\is-id8ic.tmp в %ProgramFiles%\bullzip\pdf printer\language\kdi.txt
%ProgramFiles%\bullzip\pdf printer\language\is-47ia6.tmp в %ProgramFiles%\bullzip\pdf printer\language\jpn.txt
%ProgramFiles%\bullzip\pdf printer\language\is-jgqlj.tmp в %ProgramFiles%\bullzip\pdf printer\language\ita.txt
%ProgramFiles%\bullzip\pdf printer\language\is-8e14n.tmp в %ProgramFiles%\bullzip\pdf printer\language\ind.txt
%ProgramFiles%\bullzip\pdf printer\language\is-n6aod.tmp в %ProgramFiles%\bullzip\pdf printer\language\hun.txt
%ProgramFiles%\bullzip\pdf printer\language\is-suphj.tmp в %ProgramFiles%\bullzip\pdf printer\language\hrv.txt
%ProgramFiles%\bullzip\pdf printer\language\is-us6e3.tmp в %ProgramFiles%\bullzip\pdf printer\language\hin.txt
%ProgramFiles%\bullzip\pdf printer\language\is-suq1e.tmp в %ProgramFiles%\bullzip\pdf printer\language\heb.txt
%ProgramFiles%\bullzip\pdf printer\language\is-qdvc3.tmp в %ProgramFiles%\bullzip\pdf printer\language\dan.txt
%ProgramFiles%\bullzip\pdf printer\language\is-2rgd5.tmp в %ProgramFiles%\bullzip\pdf printer\language\glc.txt
%ProgramFiles%\bullzip\pdf printer\language\is-kkkhd.tmp в %ProgramFiles%\bullzip\pdf printer\language\fin.txt
%ProgramFiles%\bullzip\pdf printer\language\is-09b9t.tmp в %ProgramFiles%\bullzip\pdf printer\language\far.txt
%ProgramFiles%\bullzip\pdf printer\language\is-juudr.tmp в %ProgramFiles%\bullzip\pdf printer\language\eti.txt
%ProgramFiles%\bullzip\pdf printer\language\is-fv9v3.tmp в %ProgramFiles%\bullzip\pdf printer\language\esn.txt
%ProgramFiles%\bullzip\pdf printer\language\is-emmep.tmp в %ProgramFiles%\bullzip\pdf printer\language\epo.txt
%ProgramFiles%\bullzip\pdf printer\language\is-lq3kc.tmp в %ProgramFiles%\bullzip\pdf printer\language\enu.txt
%ProgramFiles%\bullzip\pdf printer\language\is-619bo.tmp в %ProgramFiles%\bullzip\pdf printer\language\eng.txt
%ProgramFiles%\bullzip\pdf printer\language\is-e6l1l.tmp в %ProgramFiles%\bullzip\pdf printer\language\ena.txt
%ProgramFiles%\bullzip\pdf printer\language\is-14u9g.tmp в %ProgramFiles%\bullzip\pdf printer\language\ell.txt
%ProgramFiles%\bullzip\pdf printer\language\is-44mv5.tmp в %ProgramFiles%\bullzip\pdf printer\language\fra.txt
%ProgramFiles%\bullzip\pdf printer\language\is-bnhr4.tmp в %ProgramFiles%\bullzip\pdf printer\language\deu.txt
%ProgramFiles%\bullzip\pdf printer\language\is-go6cm.tmp в %ProgramFiles%\bullzip\pdf printer\language\lth.txt
%ProgramFiles%\bullzip\pdf printer\language\is-okbav.tmp в %ProgramFiles%\bullzip\pdf printer\language\rus.txt
%ProgramFiles%\bullzip\pdf printer\language\is-b59kt.tmp в %ProgramFiles%\bullzip\pdf printer\language\urd.txt
%ProgramFiles%\bullzip\pdf printer\language\is-78d8m.tmp в %ProgramFiles%\bullzip\pdf printer\language\ukr.txt
%ProgramFiles%\bullzip\pdf printer\language\is-tg983.tmp в %ProgramFiles%\bullzip\pdf printer\language\trk.txt
%ProgramFiles%\bullzip\pdf printer\language\is-fhc9k.tmp в %ProgramFiles%\bullzip\pdf printer\language\tha.txt
%ProgramFiles%\bullzip\pdf printer\language\is-7av90.tmp в %ProgramFiles%\bullzip\pdf printer\language\tam.txt
%ProgramFiles%\bullzip\pdf printer\language\is-53fcg.tmp в %ProgramFiles%\bullzip\pdf printer\language\sve.txt
%ProgramFiles%\bullzip\pdf printer\language\is-3tuvs.tmp в %ProgramFiles%\bullzip\pdf printer\language\sro.txt
%ProgramFiles%\bullzip\pdf printer\language\is-jbsj0.tmp в %ProgramFiles%\bullzip\pdf printer\language\srl.txt
%ProgramFiles%\bullzip\pdf printer\language\is-akj08.tmp в %ProgramFiles%\bullzip\pdf printer\language\slv.txt
%ProgramFiles%\bullzip\pdf printer\language\is-ptahp.tmp в %ProgramFiles%\bullzip\pdf printer\language\mlt.txt
%ProgramFiles%\bullzip\pdf printer\language\is-mo30l.tmp в %ProgramFiles%\bullzip\pdf printer\language\lvi.txt
%ProgramFiles%\bullzip\pdf printer\language\is-g5vmj.tmp в %ProgramFiles%\bullzip\pdf printer\language\rom.txt
%ProgramFiles%\bullzip\pdf printer\language\is-4ntvv.tmp в %ProgramFiles%\bullzip\pdf printer\language\ptg.txt
%ProgramFiles%\bullzip\pdf printer\language\is-1ccqa.tmp в %ProgramFiles%\bullzip\pdf printer\language\ptb.txt
%ProgramFiles%\bullzip\pdf printer\language\is-icu0k.tmp в %ProgramFiles%\bullzip\pdf printer\language\plk.txt
%ProgramFiles%\bullzip\pdf printer\language\is-l9tio.tmp в %ProgramFiles%\bullzip\pdf printer\language\nor.txt
%ProgramFiles%\bullzip\pdf printer\language\is-jgd1d.tmp в %ProgramFiles%\bullzip\pdf printer\language\non.txt
%ProgramFiles%\bullzip\pdf printer\language\is-3ucgp.tmp в %ProgramFiles%\bullzip\pdf printer\language\nld.txt
%ProgramFiles%\bullzip\pdf printer\language\is-obbc4.tmp в %ProgramFiles%\bullzip\pdf printer\language\nlb.txt
%ProgramFiles%\bullzip\pdf printer\language\is-t9i9k.tmp в %ProgramFiles%\bullzip\pdf printer\language\msl.txt
%ProgramFiles%\bullzip\pdf printer\language\is-9ft0v.tmp в %ProgramFiles%\bullzip\pdf printer\language\sky.txt
%ProgramFiles%\bullzip\pdf printer\language\is-5gvr4.tmp в %ProgramFiles%\bullzip\pdf printer\language\csy.txt
%ProgramFiles%\bullzip\pdf printer\language\is-8goop.tmp в %ProgramFiles%\bullzip\pdf printer\language\cht.txt
%ProgramFiles%\bullzip\pdf printer\language\is-dgmsc.tmp в %ProgramFiles%\bullzip\pdf printer\language\chs.txt
%ProgramFiles%\bullzip\pdf printer\macros\examples\is-2jcd1.tmp в %ProgramFiles%\bullzip\pdf printer\macros\examples\base.vbs
<SYSTEM32>\spool\drivers\x64\3\is-9230k.tmp в <SYSTEM32>\spool\drivers\x64\3\bullzip.ppd
<SYSTEM32>\spool\drivers\w32x86\3\is-icq56.tmp в <SYSTEM32>\spool\drivers\w32x86\3\bullzip.ppd
<SYSTEM32>\spool\drivers\w32x86\0\is-d2b4u.tmp в <SYSTEM32>\spool\drivers\w32x86\0\bullzip.ppd
%ProgramFiles%\bullzip\pdf printer\api\exe\is-1655u.tmp в %ProgramFiles%\bullzip\pdf printer\api\exe\config.exe
%ProgramFiles%\bullzip\pdf printer\api\com\is-bnjn0.tmp в %ProgramFiles%\bullzip\pdf printer\api\com\pdf printer api.chm
%CommonProgramFiles%\bullzip\pdf printer\api\com\is-kpbbs.tmp в %CommonProgramFiles%\bullzip\pdf printer\api\com\bzpdfc.dll
%ProgramFiles%\bullzip\pdf printer\is-vimfm.tmp в %ProgramFiles%\bullzip\pdf printer\program.ico
%ProgramFiles%\bullzip\pdf printer\is-ia6k7.tmp в %ProgramFiles%\bullzip\pdf printer\pdfcmd.exe
%ProgramFiles%\bullzip\pdf printer\is-knj8m.tmp в %ProgramFiles%\bullzip\pdf printer\gui.exe.manifest
%CommonProgramFiles%\bullzip\pdf printer\ports\bullzip\is-soelg.tmp в %CommonProgramFiles%\bullzip\pdf printer\ports\bullzip\bzpdf.dll
%WINDIR%\syswow64\is-sfvnq.tmp в %WINDIR%\syswow64\tabstripctlu.ocx
%WINDIR%\syswow64\is-he3kh.tmp в %WINDIR%\syswow64\lblctlsu.ocx
%WINDIR%\syswow64\is-9746a.tmp в %WINDIR%\syswow64\exlvwu.ocx
%WINDIR%\syswow64\is-hv03a.tmp в %WINDIR%\syswow64\editctlsu.ocx
%WINDIR%\syswow64\is-3mati.tmp в %WINDIR%\syswow64\cblctlsu.ocx
%WINDIR%\syswow64\is-e9rsm.tmp в %WINDIR%\syswow64\btnctlsu.ocx
%WINDIR%\syswow64\is-kf4fo.tmp в %WINDIR%\syswow64\mscomctl.ocx
%WINDIR%\syswow64\is-r6dak.tmp в %WINDIR%\syswow64\comdlg32.ocx
%ProgramFiles%\bullzip\pdf printer\is-ejdc5.tmp в %ProgramFiles%\bullzip\pdf printer\gui.exe
%ProgramFiles%\bullzip\pdf printer\is-0id6o.tmp в %ProgramFiles%\bullzip\pdf printer\documentcollector.exe
%ProgramFiles%\bullzip\pdf printer\res\ico\16x16x32bpp\is-vnkrb.tmp в %ProgramFiles%\bullzip\pdf printer\res\ico\16x16x32bpp\printer16x16.ico
%ProgramFiles%\bullzip\pdf printer\is-6iqim.tmp в %ProgramFiles%\bullzip\pdf printer\notify.exe
%ProgramFiles%\bullzip\pdf printer\language\is-jki84.tmp в %ProgramFiles%\bullzip\pdf printer\language\cat.txt
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-an8mk.tmp в %CommonProgramFiles%\bullzip\system\framework\v2.0\bullzip.pdfwriter.internalext.dll
%ProgramFiles%\bullzip\pdf printer\language\is-k7p3o.tmp в %ProgramFiles%\bullzip\pdf printer\language\bsb.txt
%ProgramFiles%\bullzip\pdf printer\language\is-ao77t.tmp в %ProgramFiles%\bullzip\pdf printer\language\bgr.txt
%ProgramFiles%\bullzip\pdf printer\language\is-6snqd.tmp в %ProgramFiles%\bullzip\pdf printer\language\bel.txt
%ProgramFiles%\bullzip\pdf printer\language\is-df1d5.tmp в %ProgramFiles%\bullzip\pdf printer\language\ara.txt
%ProgramFiles%\bullzip\pdf printer\language\is-klono.tmp в %ProgramFiles%\bullzip\pdf printer\language\afk.txt
%ProgramFiles%\bullzip\pdf printer\is-p8pm4.tmp в %ProgramFiles%\bullzip\pdf printer\labels.txt
%ProgramFiles%\bullzip\pdf printer\debug\is-jrfre.tmp в %ProgramFiles%\bullzip\pdf printer\debug\bugradar.exe
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-4l3sb.tmp в %CommonProgramFiles%\bullzip\system\framework\v4.0\bullzip.pdfwriter.xpsinternal.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-nu1nc.tmp в %CommonProgramFiles%\bullzip\system\framework\v4.0\bullzip.pdfwriter.internalext.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-2729o.tmp в %CommonProgramFiles%\bullzip\system\framework\v4.0\bullzip.pdfwriter.upload.dll
%ProgramFiles%\bullzip\pdf printer\is-e13ql.tmp в %ProgramFiles%\bullzip\pdf printer\port.exe
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-8cib0.tmp в %CommonProgramFiles%\bullzip\system\framework\v2.0\bullzip.pdfwriter.upload.dll
%CommonProgramFiles%\bullzip\system\framework\v4.0\is-fc46t.tmp в %CommonProgramFiles%\bullzip\system\framework\v4.0\bullzip.pdfwriter.lib.dll
%CommonProgramFiles%\bullzip\system\framework\v2.0\is-asfgo.tmp в %CommonProgramFiles%\bullzip\system\framework\v2.0\bullzip.pdfwriter.lib.dll
%ProgramFiles%\bullzip\pdf printer\is-h6cji.tmp в %ProgramFiles%\bullzip\pdf printer\bullzip.pdfwriter.chm
%CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v4.0\is-o6h2c.tmp в %CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v4.0\bullzip.pdfwriter.dll
%CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v2.0\is-5cvej.tmp в %CommonProgramFiles%\bullzip\pdf printer\api\microsoft.net\framework\v2.0\bullzip.pdfwriter.dll
%ProgramFiles%\bullzip\pdf printer\icc\is-775vm.tmp в %ProgramFiles%\bullzip\pdf printer\icc\srgb_iec61966-2-1_no_black_scaling.icc
%WINDIR%\syswow64\is-3gob5.tmp в %WINDIR%\syswow64\bzdct.dll
%WINDIR%\syswow64\is-oppvm.tmp в %WINDIR%\syswow64\bzflrdr.dll
%ProgramFiles%\bullzip\pdf printer\language\is-3s909.tmp в %ProgramFiles%\bullzip\pdf printer\language\vit.txt
%ProgramFiles%\bullzip\pdf printer\language\is-t650d.tmp в %ProgramFiles%\bullzip\pdf printer\language\index.ini

Сетевая активность

Подключается к

'fa###rsoft.ro':80
'fa####soft.go.ro':696
'fa####soft.go.ro':55629
'fa####soft.go.ro':55612

TCP

'fa####soft.go.ro':696

UDP

DNS ASK fa###rsoft.ro
DNS ASK fa####soft.go.ro

Другое

Создает и запускает на исполнение

'<Текущая директория>\7za.exe' -y x <Текущая директория>\BULLZIP.7z -o<Текущая директория>\BULLZIP\
'<Текущая директория>\bullzip\setup_bullzippdfprinter.exe' /sp /silent /norestart /nocancel
'%TEMP%\is-jo2so.tmp\setup_bullzippdfprinter.tmp' /SL5="$C022E,16909817,143360,<Текущая директория>\BULLZIP\Setup_BullzipPDFPrinter.exe" /sp /silent /norestart /nocancel
'%TEMP%\is-g9k8d.tmp\_isetup\_setup64.tmp' 105 0x264
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="TabTabEnter"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.InternalExt.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.InternalExt.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Upload.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Upload.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Lib.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Lib.dll /tlb' (со скрытым окном)
'<SYSTEM32>\net.exe' start spooler' (со скрытым окном)
'<SYSTEM32>\net.exe' STOP SPOOLER /Y' (со скрытым окном)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PDFWriter.dll /tlb' (со скрытым окном)
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.XpsInternal.dll /tlb' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c <Текущая директория>\BULLZIP\BullzipInstallScript.bat' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\7zx.bat' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=out action=allow enable=yes protocol=udp program="<Текущая директория>\TabTabEnter.exe"' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=out action=allow enable=yes protocol=tcp program="<Текущая директория>\TabTabEnter.exe"' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=in action=allow enable=yes protocol=udp program="<Текущая директория>\TabTabEnter.exe"' (со скрытым окном)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="TabTabEnter" dir=in action=allow enable=yes protocol=tcp program="<Текущая директория>\TabTabEnter.exe"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PDFWriter.dll /tlb' (со скрытым окном)
'<SYSTEM32>\regsvr32.exe' /s vbscript.dll' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="TabTabEnter"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\bzDCT.dll"
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PDFWriter.dll /tlb
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PDFWriter.dll /tlb
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Lib.dll /tlb
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Lib.dll /tlb
'%WINDIR%\syswow64\regsvr32.exe' /s "%CommonProgramFiles%\Bullzip\PDF Printer\API\COM\bzpdfc.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\bzFlRdr.dll"
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Upload.dll /tlb
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.InternalExt.dll /tlb
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.XpsInternal.dll /tlb
'<SYSTEM32>\regsvr32.exe' /s vbscript.dll
'%WINDIR%\syswow64\regsvr32.exe' /u /s "%WINDIR%\SysWOW64\comdlg32.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\SysWOW64\comdlg32.ocx"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.Upload.dll /tlb
'%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /codebase Bullzip.PdfWriter.InternalExt.dll /tlb
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\TabStripCtlU.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\LblCtlsU.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\ExLvwU.ocx"
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\7zx.bat
'%WINDIR%\syswow64\cmd.exe' /c <Текущая директория>\BULLZIP\BullzipInstallScript.bat
'<SYSTEM32>\net1.exe' STOP SPOOLER /Y
'<SYSTEM32>\net.exe' start spooler
'<SYSTEM32>\net1.exe' start spooler
'<SYSTEM32>\spoolsv.exe'
'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\msxml6.dll"
'<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\SysWOW64\msscript.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\comdlg32.OCX"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\mscomctl.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\BtnCtlsU.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\CBLCtlsU.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\EditCtlsU.ocx"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\msxml6.dll"
'%WINDIR%\syswow64\regsvr32.exe' /u /s "%WINDIR%\SysWOW64\mscomctl.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\SysWOW64\mscomctl.ocx"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней