Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.bdmpeg' = 'bdmpega.acm'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mpeg' = 'bdmpegv.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mjpg' = 'bdmjpeg.dll'
Malicious functions:
Creates and executes the following:
- '%TEMP%\BDMPEG1SETUP.EXE' /S
- '%CommonProgramFiles%\~tkpauzx.ibo' /S
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\BandiMPEG1\bdfilters64.dll"
Modifies file system:
Creates the following files:
- %ProgramFiles%\Bandicam\lang\Lithuanian.ini
- %ProgramFiles%\Bandicam\lang\Malay.ini
- %ProgramFiles%\Bandicam\lang\Latvian.ini
- %ProgramFiles%\Bandicam\lang\khmer.ini
- %ProgramFiles%\Bandicam\lang\Kurdish.ini
- %ProgramFiles%\Bandicam\lang\Norwegian.ini
- %ProgramFiles%\Bandicam\lang\Romanian.ini
- %ProgramFiles%\Bandicam\lang\Russian.ini
- %ProgramFiles%\Bandicam\lang\Portuguese(BR).ini
- %ProgramFiles%\Bandicam\lang\Polish.ini
- %ProgramFiles%\Bandicam\lang\Portuguese.ini
- %ProgramFiles%\Bandicam\lang\Georgian.ini
- %ProgramFiles%\Bandicam\lang\German.ini
- %ProgramFiles%\Bandicam\lang\French.ini
- %ProgramFiles%\Bandicam\lang\Farsi.ini
- %ProgramFiles%\Bandicam\lang\Finnish.ini
- %ProgramFiles%\Bandicam\lang\Greek.ini
- %ProgramFiles%\Bandicam\lang\Italian.ini
- %ProgramFiles%\Bandicam\lang\Japanese.ini
- %ProgramFiles%\Bandicam\lang\Indonesian.ini
- %ProgramFiles%\Bandicam\lang\Hebrew.ini
- %ProgramFiles%\Bandicam\lang\Hungarian.ini
- %ProgramFiles%\Bandicam\data\language.dat
- %ProgramFiles%\Bandicam\data\sample.png
- %ProgramFiles%\Bandicam\lang\Vietnamese.ini
- %ProgramFiles%\Bandicam\lang\Urdu.ini
- %ProgramFiles%\Bandicam\lang\Uzbek.ini
- %ProgramFiles%\Bandicam\data\camera.wav
- <SYSTEM32>\D3DCompiler_47.dll
- %ProgramFiles%\Bandicam\uninstall.exe
- <SYSTEM32>\vcomp140.dll
- %ProgramFiles%\Bandicam\data\effects.dat
- %ProgramFiles%\Bandicam\data\skin.dat
- %ProgramFiles%\Bandicam\lang\Slovak.ini
- %ProgramFiles%\Bandicam\lang\Slovenian.ini
- %ProgramFiles%\Bandicam\lang\Simplified_Chinese.ini
- %ProgramFiles%\Bandicam\lang\Serbian(Cyrillic).ini
- %ProgramFiles%\Bandicam\lang\Serbian.ini
- %ProgramFiles%\Bandicam\lang\Spanish.ini
- %ProgramFiles%\Bandicam\lang\Turkish.ini
- %ProgramFiles%\Bandicam\lang\Ukrainian.ini
- %ProgramFiles%\Bandicam\lang\Traditional_Chinese.ini
- %ProgramFiles%\Bandicam\lang\Swedish.ini
- %ProgramFiles%\Bandicam\lang\Thai.ini
- %ProgramFiles%\Bandicam\bdfix.exe
- %ProgramFiles%\Bandicam\bdcamih.dll
- %ProgramFiles%\Bandicam\bdcam64.bin
- %ProgramFiles%\Bandicam\bdcam.exe
- %ProgramFiles%\Bandicam\bdcam_nonadmin.exe
- %ProgramFiles%\Bandicam\bandicam.ini
- %ProgramFiles%\Bandicam\bdcam64.dll
- %ProgramFiles%\Bandicam\amf-component-vce-windesktop32.dll
- %ProgramFiles%\Bandicam\bdcam.dll
- %ProgramFiles%\Bandicam\bdcap32.dll
- %ProgramFiles%\Bandicam\bdcap64.dll
- %TEMP%\nsp4.tmp
- %TEMP%\bdfilters.dll
- %TEMP%\BDMPEG1SETUP.EXE
- %TEMP%\aut1.tmp
- %CommonProgramFiles%\~tkpauzx.ibo
- %ProgramFiles%\BandiMPEG1\bdfilters.dll
- <SYSTEM32>\bdmpega.acm
- %ProgramFiles%\BandiMPEG1\uninstall.exe
- <SYSTEM32>\bdmpegv.dll
- %ProgramFiles%\BandiMPEG1\bdfilters64.dll
- <SYSTEM32>\bdmjpeg.dll
- %ProgramFiles%\Bandicam\lang\Bosnian.ini
- %ProgramFiles%\Bandicam\lang\Bulgarian.ini
- %ProgramFiles%\Bandicam\lang\Belarusian.ini
- %ProgramFiles%\Bandicam\lang\Armenian.ini
- %ProgramFiles%\Bandicam\lang\Azerbaijani.ini
- %ProgramFiles%\Bandicam\lang\Burmese.ini
- %ProgramFiles%\Bandicam\lang\Dutch.ini
- %ProgramFiles%\Bandicam\lang\English.ini
- %ProgramFiles%\Bandicam\lang\Danish.ini
- %ProgramFiles%\Bandicam\lang\Croatian.ini
- %ProgramFiles%\Bandicam\lang\Czech.ini
- %ProgramFiles%\Bandicam\bdcamvk32.dll
- %ProgramFiles%\Bandicam\bdcamvk64.dll
- %ProgramFiles%\Bandicam\amf-core-windesktop64.dll
- %ProgramFiles%\Bandicam\amf-component-vce-windesktop64.dll
- %ProgramFiles%\Bandicam\amf-core-windesktop32.dll
- %ProgramFiles%\Bandicam\bdcamvk32.json
- %ProgramFiles%\Bandicam\translators.txt
- %ProgramFiles%\Bandicam\lang\Arabic.ini
- %ProgramFiles%\Bandicam\UnregVulkanLayer.bat
- %ProgramFiles%\Bandicam\bdcamvk64.json
- %ProgramFiles%\Bandicam\RegVulkanLayer.bat
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\~tkpauzx.ibo
Deletes the following files:
- %TEMP%\BDMPEG1SETUP.EXE
- %TEMP%\nsd5.tmp\System.dll
- %TEMP%\aut1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Bandicam1.x' WindowName: ''
- ClassName: 'Bandicam2.x' WindowName: ''