ManyCam_8[.]1[.]0[.]3_by_ThePirateCity[.]Co[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

ManyCam_8.1.0.3_by_ThePirateCity.Co.zip
Size

116.9MB
MD5

f9dc9b713e2a1b566a2deaaff16ddb98
SHA1

96bed95c586fc9b4056a2ce42f32fd06148ff833
SHA256

676d74e5d04fadde5e424189d22999c8c1d56c257fcb79a8bd106af3ba49376d
SHA512

ae3f62a50edb4a2dfb93254e3f4403c26925e84f91cc39a4eb949019ebc38025f3eea79bef11b236f1beb5d9b0b99baf677328574d00e77d5c0102655dd2921a
SSDEEP

3145728:mvB0R2vRidH6Nrg0qxbCwLOxKpulW2ILQzsH1gw:mJ08IH6NM0qxb5O7oAGaw

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ManyCam 8.1.0.3 by ThePirateCity.Co/Crack/ManyCam8103.exe
unpack002/Patch.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PLUGINSDIR/nsProcess.dll

Files

ManyCam_8.1.0.3_by_ThePirateCity.Co.zip
.zip
ManyCam 8.1.0.3 by ThePirateCity.Co/Crack/ManyCam8103.exe
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ManyCam 8.1.0.3 by ThePirateCity.Co/Crack/Patch.rar
.rar
Patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ManyCam 8.1.0.3 by ThePirateCity.Co/INSTRUCTIONS.txt
ManyCam 8.1.0.3 by ThePirateCity.Co/Loader/Read.txt
ManyCam 8.1.0.3 by ThePirateCity.Co/ManyCamSetup8103.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:e3:6e:97:97:ae:bc:c0:ed:a8:60:81:72:f2:7c:10
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22-06-2021 00:00

Not After

26-06-2024 23:59

Subject

SERIALNUMBER=4001926,CN=PALTALK\, INC.,OU=DevOps,O=PALTALK\, INC.,L=New York,ST=New York,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06-04-2022 07:45

Not After

08-05-2033 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:34:b1:45:6b:20:2e:a7:4d:d9:52:8d:84:c3:d3:27:71:20:d6:62:55:37:3e:cc:72:84:7d:31:0d:c2:35:a6
Signer

Actual PE Digest

1b:34:b1:45:6b:20:2e:a7:4d:d9:52:8d:84:c3:d3:27:71:20:d6:62:55:37:3e:cc:72:84:7d:31:0d:c2:35:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/ManyCam/Effects/Effect Packs/Animals.mcep
.zip
Chewing cat.mcv
.zip
effect.json
images/main/15.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Dino 2.mcv
.zip
effect.json
images/main/Dino3 3D.png
.png
images/thumbnail/large.jpg
.jpg
images/thumbnail/medium.jpg
.jpg
images/thumbnail/small.jpg
.jpg
properties.json
Dino.mcv
.zip
effect.json
images/main/Dino2 3D.png
.png
images/thumbnail/large.jpg
.jpg
images/thumbnail/medium.jpg
.jpg
images/thumbnail/small.jpg
.jpg
properties.json
Dog Animated.mcv
.zip
effect.json
images/main/10.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Fainting Cat.mcv
.zip
effect.json
images/main/4.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Fish swimming.mcv
.zip
Happy Panda.mcv
.zip
Horse.mcv
.zip
Hungry Cat.mcv
.zip
Lion.mcv
.zip
Panda Animated.mcv
.zip
Pig Animated.mcv
.zip
Rabbit.mcv
.zip
Royal Corgi.mcv
.zip
Serenade Cat.mcv
.zip
Shark.mcv
.zip
Sleeping Panda.mcv
.zip
Walking Cat.mcv
.zip
effect_pack_info.json
$APPDATA/ManyCam/Effects/Effect Packs/Borders.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Distortions.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Education.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Emojis.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FaceAccessories.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FaceMasks.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Filters.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FoodsAndBeverages.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Groups.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/LowerThirds.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Objects.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Overlays.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Sports.mcep
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-01.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-02.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-03.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-04.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-05.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-06.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-07.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-08.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-09.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-10.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-11.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-12.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-13.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-14.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-15.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-16.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-17.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-18.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-19.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-20.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-21.mclt2
.zip
$APPDATA/ManyCam/Stamps/chat.mbr
.zip
$APPDATA/ManyCam/Stamps/flash.mbr
.zip
$APPDATA/ManyCam/Stamps/heart.mbr
.zip
$APPDATA/ManyCam/Stamps/leafs.mbr
.zip
$APPDATA/ManyCam/Stamps/like.mbr
.zip
$APPDATA/ManyCam/Stamps/music.mbr
.zip
$APPDATA/ManyCam/Stamps/star.mbr
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Animals.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Borders.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Distortions.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Education.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Emojis.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FaceAccessories.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FaceMasks.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Filters.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FoodsAndBeverages.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Groups.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/LowerThirds.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Objects.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Overlays.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Sports.mcep
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-01.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-02.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-03.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-04.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-05.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-06.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-07.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-08.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-09.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-10.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-11.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-12.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-13.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-14.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-15.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-16.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-17.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-18.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-19.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-20.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-21.mclt2
.zip
$APPDATA/ManyCam/UserAppData/Stamps/chat.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/flash.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/heart.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/leafs.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/like.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/music.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/star.mbr
.zip
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

1fe003b76229a0ffee4a9219893de38e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExW
lstrcmpiW
GetCurrentThreadId
GetProcAddress
GetCommandLineW
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
SetEvent
SetLastError
SetCurrentDirectoryW
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetExitCodeThread
CreateThread
CreateFileMappingW
CreateEventW
lstrlenW
GlobalAlloc
CreateProcessW
GetLastError
FormatMessageW
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
DuplicateHandle
LoadLibraryA

user32

SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
DefWindowProcW
PostMessageW
SetForegroundWindow
CreateWindowExW
GetWindowThreadProcessId
CallWindowProcW
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClassNameW
CallNextHookEx
CharNextW
DialogBoxParamW
MessageBoxW
EndDialog
SetWindowLongW
LoadImageW
GetWindowLongW
EnableWindow
ShowWindow
wsprintfW
LoadStringW
GetDlgItem
SendMessageW
DestroyWindow

advapi32

GetUserNameW
OpenSCManagerW
GetTokenInformation
OpenProcessToken
FreeSid
CloseServiceHandle
EqualSid
AllocateAndInitializeSid
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
QueryServiceStatus
OpenServiceW

shell32

ShellExecuteExW

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 894B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/mdsu.exe
.exe windows:6 windows x64 arch:x64

a3cf5b7db5bb1be9f0531da9a8015cab

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18-02-2019 00:00

Not After

28-02-2022 23:59

Subject

SERIALNUMBER=1145963121,CN=ManyCam (VISICOM MÉDIA INC.),O=ManyCam (VISICOM MÉDIA INC.),L=Brossard,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130842726f7373617264,1.3.6.1.4.1.311.60.2.1.2=#1306517565626563,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

Actual PE Digest

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\work\projects\manycam\win_git\prebuild\driver_setup_utility\!out\x64\mdsu_x64.pdb

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
LocalFree
FormatMessageW
FileTimeToSystemTime
CloseHandle
WriteConsoleW
SetFilePointerEx
OutputDebugStringW
GetConsoleMode
GetConsoleCP
LoadLibraryW
lstrlenW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
GetLastError
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDateFormatW
FindClose
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStartupInfoW
GetFileType
GetStdHandle
FatalAppExitA
DeleteCriticalSection
GetCurrentThreadId
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
GetACP
CreateFileW
IsValidCodePage
IsDebuggerPresent
HeapSize
WideCharToMultiByte
MultiByteToWideChar
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc

user32

LoadStringW
CharNextW
BroadcastSystemMessageW
CharPrevW

advapi32

RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegCloseKey
InitiateSystemShutdownExW

ole32

CLSIDFromString

setupapi

CM_Disconnect_Machine
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Free_Log_Conf_Handle
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW

Exports

Exports

mdsu_add_device
mdsu_list_devices
mdsu_remove_all
mdsu_remove_device
mdsu_rename_device

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/video/mdsu.exe
.exe windows:6 windows x64 arch:x64

a3cf5b7db5bb1be9f0531da9a8015cab

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18-02-2019 00:00

Not After

28-02-2022 23:59

Subject

SERIALNUMBER=1145963121,CN=ManyCam (VISICOM MÉDIA INC.),O=ManyCam (VISICOM MÉDIA INC.),L=Brossard,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130842726f7373617264,1.3.6.1.4.1.311.60.2.1.2=#1306517565626563,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

Actual PE Digest

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\work\projects\manycam\win_git\prebuild\driver_setup_utility\!out\x64\mdsu_x64.pdb

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
LocalFree
FormatMessageW
FileTimeToSystemTime
CloseHandle
WriteConsoleW
SetFilePointerEx
OutputDebugStringW
GetConsoleMode
GetConsoleCP
LoadLibraryW
lstrlenW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
GetLastError
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDateFormatW
FindClose
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStartupInfoW
GetFileType
GetStdHandle
FatalAppExitA
DeleteCriticalSection
GetCurrentThreadId
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
GetACP
CreateFileW
IsValidCodePage
IsDebuggerPresent
HeapSize
WideCharToMultiByte
MultiByteToWideChar
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc

user32

LoadStringW
CharNextW
BroadcastSystemMessageW
CharPrevW

advapi32

RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegCloseKey
InitiateSystemShutdownExW

ole32

CLSIDFromString

setupapi

CM_Disconnect_Machine
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Free_Log_Conf_Handle
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW

Exports

Exports

mdsu_add_device
mdsu_list_devices
mdsu_remove_all
mdsu_remove_device
mdsu_rename_device

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ManyCam 8.1.0.3 by ThePirateCity.Co/Visit - ThePirateCity.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: - Virtual size: 16KB

.data Size: 3KB - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 512B - Virtual size: 502B

.rdata Size: 512B - Virtual size: 472B

.data Size: 512B - Virtual size: 52B

.rsrc Size: 226KB - Virtual size: 225KB

.reloc Size: 512B - Virtual size: 82B

32f3282581436269b3a75b6675fe3e08

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:e3:6e:97:97:ae:bc:c0:ed:a8:60:81:72:f2:7c:10Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

1b:34:b1:45:6b:20:2e:a7:4d:d9:52:8d:84:c3:d3:27:71:20:d6:62:55:37:3e:cc:72:84:7d:31:0d:c2:35:a6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.4MB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

1fe003b76229a0ffee4a9219893de38e

Headers

File Characteristics

Imports

kernel32

user32

.text
Size: - Virtual size: 16KB

.data
Size: 3KB - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.text
Size: 512B - Virtual size: 502B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 52B

.rsrc
Size: 226KB - Virtual size: 225KB

.reloc
Size: 512B - Virtual size: 82B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:e3:6e:97:97:ae:bc:c0:ed:a8:60:81:72:f2:7c:10
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

1b:34:b1:45:6b:20:2e:a7:4d:d9:52:8d:84:c3:d3:27:71:20:d6:62:55:37:3e:cc:72:84:7d:31:0d:c2:35:a6
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.4MB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1024B - Virtual size: 894B

.text
Size: 1024B - Virtual size: 686B

.rdata
Size: 1024B - Virtual size: 753B

.data
Size: 512B - Virtual size: 48B

.reloc
Size: 512B - Virtual size: 240B

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 8KB - Virtual size: 21KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 44KB - Virtual size: 44KB

.reloc
Size: 3KB - Virtual size: 2KB