Technical Information
Modifies file system
Creates the following files
- %TEMP%\nsrc024.tmp\system.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win10\avxcx311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win7\avxcx311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win8\avxcx311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\avxcx311_x64.cat
- <SYSTEM32>\customer_avxcx311.bin
- <SYSTEM32>\format_avxcx311.bin
- %TEMP%\nsrc024.tmp\nsexec.dll
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setf8ee.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfa46.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfb8f.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfd74.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setff0a.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set24.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set12e.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set286.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set3a0.tmp
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set4ba.tmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\nosignal.v210
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set5d4.tmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\invalidscaler.v210
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\customer_avxcx311.bin
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\avxcx311_x64.sys
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\averstreamformat.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\averstreamformat64.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\avermediaxbarcx311.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\avermediaxbarcx31164.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cn312_x64.inf
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cx311_x64.inf
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\install.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\installdriver.exe
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\remove.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\removedriver.exe
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\videoprocpropcx311.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\videoprocpropcx31164.dll
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_custom_hdcp_protection.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_custom_no_signal.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_custom_out_of_range.bmp
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_devcon_x64.exe
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\format_avxcx311.bin
- %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set72c.tmp
Deletes the following files
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win10\avxcx311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win7\avxcx311_x64.cat
- %ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\cat\win8\avxcx311_x64.cat
Moves the following files
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setf8ee.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\cx311_x64.inf
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfa46.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\averstreamformat.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfb8f.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\aver_custom_no_signal.bmp
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setfd74.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\avermediaxbarcx311.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\setff0a.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\videoprocpropcx311.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set24.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\averstreamformat64.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set12e.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\avermediaxbarcx31164.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set286.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\aver_custom_hdcp_protection.bmp
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set3a0.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\videoprocpropcx31164.dll
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set4ba.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\avxcx311_x64.cat
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set5d4.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\aver_custom_out_of_range.bmp
- from %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\set72c.tmp to %TEMP%\{65a53867-225c-0a70-d762-711fc653ec6a}\avxcx311_x64.sys
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_devcon_x64.exe' rescan
- '%ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_devcon_x64.exe' dp_add Cx311_x64.inf
- '%ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_devcon_x64.exe' rescan' (with hidden window)
- '%ProgramFiles(x86)%\avermedia\avermedia cx311 pcie device\aver_devcon_x64.exe' dp_add Cx311_x64.inf' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{740d638a-455c-5f78-47fc-94635827884e} Global\{76f48bc2-04a5-21f5-989f-390d883b6d7a} <DRIVERSTORE>\Temp\{353dad57-5d51-723f-8a68-ef6b...
