Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\c__bcamyt_<File name>.exe.job
- <SYSTEM32>\tasks\c__bcamyt_<File name>.exe
Modifies file system
Creates the following files
- %APPDATA%\hamamatsu\ndp.view 2\install\decoder.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\ndpi.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\ndp.view logos.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\map.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\atlas2.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\atlas2-1024.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\atlas.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\atlas-1024.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\annotations.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\windowdragoverlays.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\windowchat.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\window.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\tooltip.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\tabstrip.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\slideimage.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\settings.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\working.tga
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\reviewsettings.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\progress.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\messagebox.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\menu.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\lutcontrols.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\inputbox.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\info.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\imagecontrols.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\imagearea.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\histogram.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\help.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\gotourl.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\exportresize.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\signin.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\german.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndp.view 2.6.8 setup.msi
- %TEMP%\msif452.tmp
- %TEMP%\ai_extui_bin_2424\stddllwrapper.dll_1
- %TEMP%\ai_extui_bin_2424\stddllwrapper.dll
- %TEMP%\ai_extui_bin_2424\lzmaextractor.dll
- %TEMP%\ai_extui_bin_2424\cmdlinkarrow
- %TEMP%\ai_extui_bin_2424\applogoicon
- %TEMP%\ai_extui_bin_2424\aicustact.dll
- %TEMP%\ai_extui_bin_2424\prereq.dll
- %TEMP%\ai_extui_bin_2424\whitebackground
- %TEMP%\ai_extui_bin_2424\waitlogoicon
- %TEMP%\ai_extui_bin_2424\up
- %TEMP%\ai_extui_bin_2424\tabback
- %TEMP%\ai_extui_bin_2424\repairic
- %TEMP%\ai_extui_bin_2424\removico
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\exportannotations.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\sn0.tga
- %TEMP%\ai_extui_bin_2424\new
- %TEMP%\ai_extui_bin_2424\minbackground
- %TEMP%\ai_extui_bin_2424\insticon
- %TEMP%\ai_extui_bin_2424\installlogoicon
- %TEMP%\ai_extui_bin_2424\info
- %TEMP%\ai_extui_bin_2424\exitbackground
- %TEMP%\ai_extui_bin_2424\exclamic
- %TEMP%\ai_extui_bin_2424\custicon
- %TEMP%\ai_extui_bin_2424\completi
- %TEMP%\ai_extui_bin_2424\background
- %TEMP%\ai_extui_bin_2424\ndpview2.ico
- %TEMP%\msif2ab.tmp
- %TEMP%\msif28b.tmp
- %TEMP%\msif02a.tmp
- %TEMP%\ai_extui_bin_2424\optionslogoicon
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndp.view 2.6.8 setup.x64.msi
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\export.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\dragoverlays.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\counttracker.rml
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86_xp.inf
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\license.txt
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\fix file associations and thumbnails.vbs
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\rkt.css
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\ndpview.css
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\lutshader.ps
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gridshader.ps
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\backgroundplus.bmp
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\background.bmp
- %WINDIR%\temp\oldadcb.tmp
- %TEMP%\dx6ac3.tmp\infinst.exe
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64_xp.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64.cat
- %TEMP%\msif4a1.tmp
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndpview2.exe
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86.cat
- %TEMP%\dx6ac3.tmp\d3dx9_43.dll
- %TEMP%\dx6ac3.tmp\jun2010_d3dx9_43_x64.inf
- %TEMP%\dx6ac3.tmp\jun2010_d3dx9_43_x86.inf
- %TEMP%\dx6ac3.tmp\dxupdate.cif
- %TEMP%\dx6ac3.tmp\dxupdate.inf
- %TEMP%\dx6ac3.tmp\dxupdate.dll
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\jun2010_d3dx9_43_x86.cab
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\jun2010_d3dx9_43_x64.cab
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\dxupdate.cab
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\dsetup32.dll
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\dsetup.dll
- %TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\dxsetup.exe
- %WINDIR%\temp\oldac0a.tmp
- %TEMP%\ai_extui_bin_2424\printico
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\32-bit\ndpview2.exe
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndpview2.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndpshellex.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\conferencechat.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\conference.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\browse.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\annotationtag.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\annotationlist.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\annotationdetails.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\gui\about.rml
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\reviewareas\thinprep.ndpa
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\reviewareas\surepath.ndpa
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\swedish.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\spanish.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\portuguese.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\korean.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\32-bit\ndpshellex.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\japanese.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\regtemplate.txt
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\french.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\english.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\dutch.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\chinese.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\basque.lan
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\annotations\mitotic density box.ano
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\annotations\2 x rbc.ano
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\annotations\1 x rbc.ano
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\32-bit\ndpview2.ocx
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\ndpview2.ocx
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\32-bit\softekbarcode.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\softekbarcode.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\32-bit\ndpview2.dll
- %APPDATA%\hamamatsu\ndp.view 2\install\cb456a2\languages\italian.lan
- %TEMP%\msif4e0.tmp
Deletes the following files
- %TEMP%\dx6ac3.tmp\d3dx9_43.dll
- %TEMP%\msif452.tmp
- %TEMP%\msif2ab.tmp
- %TEMP%\msif28b.tmp
- %TEMP%\msif02a.tmp
- %TEMP%\dx6ac3.tmp\jun2010_d3dx9_43_x86.inf
- %TEMP%\dx6ac3.tmp\jun2010_d3dx9_43_x64.inf
- %TEMP%\dx6ac3.tmp\infinst.exe
- %TEMP%\dx6ac3.tmp\dxupdate.inf
- %TEMP%\msif4a1.tmp
- %TEMP%\dx6ac3.tmp\dxupdate.dll
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86_xp.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x86.cat
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64_xp.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64.inf
- %TEMP%\dx6ac3.tmp\d3dx9_43_x64.cat
- %WINDIR%\temp\oldadcb.tmp
- %WINDIR%\temp\oldac0a.tmp
- %TEMP%\dx6ac3.tmp\dxupdate.cif
- %TEMP%\msif4e0.tmp
Substitutes the following files
- %TEMP%\dx6ac3.tmp\d3dx9_43.dll
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\{5b34125a-3bf0-4215-94a5-4693bcb456a2}\dxsetup.exe' /silent
- '%TEMP%\dx6ac3.tmp\infinst.exe' D3DX9_43_x64.inf
