Overview

overview

8

Static

static

3

ManyCamSetup.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    64s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 13:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ManyCamSetup.exe

  • Size

    124.5MB

  • MD5

    c9b082accc349f96220e94db97cb2f76

  • SHA1

    18d7e4a8f0e8ee3403f18e544fc854465a153d1c

  • SHA256

    f31445d1d91bec8e0ad59913808e62a3998c3156bf4d1fc1349e4464f25017bc

  • SHA512

    dbb83beb52e91e608c74eb5cf359779ff3d7b8c9df3285bf9c0561c0229453cd512f34fa075727c124bd805c04a2c610e49457899192df66de14d5ed8ff6c1fb

  • SSDEEP

    3145728:CBOiT+72oMmW1beioZia2yCupqVR9yfJg2wQBP4vvNR:AO57omW1beio0apURAJg9QBEvv

Score
8/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 8 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Drops file in System32 directory 33 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 17 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ManyCamSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\ManyCamSetup.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall delete rule name="ManyCam Virtual Webcam"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2980
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="ManyCam Virtual Webcam" dir=in action=allow program="C:\Program Files (x86)\ManyCam\ManyCam.exe" enable=yes profile=domain,private,public
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2256
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule name="ManyCam Virtual Webcam" new enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2100
    • C:\Windows\SYSTEM32\pnputil.exe
      pnputil.exe /enum-drivers
      2⤵
        PID:3412
      • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe
        "C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe" remove_all_video_devices
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1708
      • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
        "C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe" add_by_name "ManyCam Virtual Webcam"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3672
      • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe
        "C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe" remove ManyCamAudio
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1060
      • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe
        "C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe" install "C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mcaudrv\mcaudrv_x64.inf" ManyCamAudio
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:4612
      • C:\ProgramData\ManyCam\Service\ManyCamService.exe
        "C:\ProgramData\ManyCam\Service\ManyCamService.exe" install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3740
      • C:\ProgramData\ManyCam\Service\ManyCamService.exe
        "C:\ProgramData\ManyCam\Service\ManyCamService.exe" start
        2⤵
        • Executes dropped EXE
        PID:872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 2284
        2⤵
        • Program crash
        PID:3992
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d5ba82e4-e911-ac42-8f7f-68a12fe2b67c}\mcvidrv.inf" "9" "4b6092e43" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\manycam\drivers\video"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4872
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\IMAGE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:79f41c50f9c9ad7b:ManyCam.Device:8.0.21.0:manycam," "4b6092e43" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4128
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9e1fdfcb-a96b-ed4a-b343-bd137894a497}\mcaudrv_x64.inf" "9" "4ea6deb4b" "0000000000000150" "WinSta0\Default" "000000000000015C" "208" "c:\users\admin\appdata\local\temp\nspabb3.tmp\mcaudrv"
        2⤵
        • Manipulates Digital Signatures
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{7844a764-9909-ee47-b7cb-a1f26d5292d2} Global\{77359bdc-7038-f743-8556-574f787dc00a} C:\Windows\System32\DriverStore\Temp\{0baad1be-2980-9742-8643-48d1756d0289}\mcaudrv_x64.inf C:\Windows\System32\DriverStore\Temp\{0baad1be-2980-9742-8643-48d1756d0289}\mcaudrv_x64.cat
          3⤵
            PID:1872
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca1116c38308:mcaudrv_Simple:4.1.0.0:manycamaudio," "4ea6deb4b" "0000000000000150"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
        1⤵
          PID:2372
        • C:\ProgramData\ManyCam\Service\ManyCamService.exe
          C:\ProgramData\ManyCam\Service\ManyCamService.exe
          1⤵
          • Executes dropped EXE
          PID:2140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3976 -ip 3976
          1⤵
            PID:3920

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                Component Object Model Hijacking

                1
                T1546.015

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                1
                T1112

                Subvert Trust Controls

                2
                T1553

                Install Root Certificate

                1
                T1553.004

                SIP and Trust Provider Hijacking

                1
                T1553.003

                Credential Access

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\ManyCam\drivers\video\mcvidrv.inf
                  Filesize

                  4KB

                  MD5

                  d7808e7edaf49f71eacd6d2a8a7b7d77

                  SHA1

                  62509418e049d337db47a6ffd408a77e1cf4042a

                  SHA256

                  5d6b10534c4b717cb3969a0bf07692e0662b629c61b8f25fd16f5671ae7d1385

                  SHA512

                  38362f9950c482758f6c9803b3ec90caea7cffab420c7f7e65e1fa3d29f7c5c9b7e2b810e8f7de3d7794665c19310ecff8cc65a8be5826fadcd7228fff0c330e

                  Download Submit

                • C:\ProgramData\ManyCam\Service\ManyCamService.exe
                  Filesize

                  532KB

                  MD5

                  f0db70ea6b32da9e8d3dfe50206cf9c4

                  SHA1

                  d1c55d2e837355d3b9df4dd35b9a51617c92f32e

                  SHA256

                  f2ce20e7019c029388a24326b149b0fbf17649f2ba805c96e9f6fb27eb4cb3cd

                  SHA512

                  030b3096eb5db42f0a14b5c416b95ec04246669b1b8d53686a8306c077a2d2b96749b4f430c0b9f0f12a75391f87be882124433126a3848582600eb3b663b6cd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\AccessControl.dll
                  Filesize

                  15KB

                  MD5

                  f894e7068ee5f5b4489d7acdde7112c9

                  SHA1

                  79ec857791ad4ac76673b05e6fc44e55315424ef

                  SHA256

                  3948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab

                  SHA512

                  e85b2bdc27b9721425bb03393e8aad897647053c77d7862ea541e03dc896173af6eaaf182514d46464d560d15c6b9d4652690885426ac1c68e2b9dd8d632e816

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\ExecDos.dll
                  Filesize

                  6KB

                  MD5

                  774e3b33d151413dc826bf2421cd51e8

                  SHA1

                  ab2928dcf6fa54bb9eb16e5f64bfcffaaeee90fa

                  SHA256

                  91d5481f576382164703e4ac244052265769377838ac30233ad79c983ed9d454

                  SHA512

                  3cf955b13e81e4b6edb292df751ce7f64b0cf30979f57b1609f002859b4e68adc046b6674f76f7b7ce7144382316c344c11fed02d638e62fcc8464c32795a365

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\InstallerAssistant.dll
                  Filesize

                  977KB

                  MD5

                  8751a5837085dc48715e2473d646ac17

                  SHA1

                  3b6f5239def7d39bb8b6d32b087b062ce02fd640

                  SHA256

                  502de1cba283dfaaa80635add4cfbd6d10f896a96ded55325343e5be168851b0

                  SHA512

                  ef036affdc001589bef13ef75c619b9eb2c5d657f0bb6151262799da2e26f881b2f6522a231100d9a365cc55c41ba68b04df86d17007c4749939a4e8c1986a0c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  bf712f32249029466fa86756f5546950

                  SHA1

                  75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

                  SHA256

                  7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

                  SHA512

                  13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\UAC.dll
                  Filesize

                  13KB

                  MD5

                  c71733d8ef33afcc99050ba2b0c56614

                  SHA1

                  52b5deb2fba8cdd5fa658baa59ff8d5c9fdf5c5c

                  SHA256

                  eb80dc6d72e39c829aa2e7370acde86b4bdcc416b65bacb970c4be9ca7928b98

                  SHA512

                  2332845dc5a4b38decc640c9391ad1714451dc33d39a2baf56e57879fedd71d5b487995647753272993d67c9341c5a40d5b67a2a3dacb6c809177913aeb92f67

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\UserInfo.dll
                  Filesize

                  4KB

                  MD5

                  c7ce0e47c83525983fd2c4c9566b4aad

                  SHA1

                  38b7ad7bb32ffae35540fce373b8a671878dc54e

                  SHA256

                  6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

                  SHA512

                  ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\inetc.dll
                  Filesize

                  24KB

                  MD5

                  640bff73a5f8e37b202d911e4749b2e9

                  SHA1

                  9588dd7561ab7de3bca392b084bec91f3521c879

                  SHA256

                  c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

                  SHA512

                  39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mcaudrv\mcaudrv_x64.inf
                  Filesize

                  4KB

                  MD5

                  6ad8455d2d85111bc42c5b900a122825

                  SHA1

                  68692d26dde73c9d094f787a799e311efbedd39b

                  SHA256

                  0f15b959f3a05c04b6941c11b518c01e444853f4f8b351d7486ac82e677a85ea

                  SHA512

                  60fc03eef2c3d929d5611ffdae7798c3368d69805ddc244260c9b99d6a8fc2dbca83fedd5ec765fb6f0486fd10f239b91bd345605c1662e6dc5a68c1f528ae98

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\mdsu.exe
                  Filesize

                  353KB

                  MD5

                  e3f8ac8f94f22db714219ccc4ee3e559

                  SHA1

                  4f06d59c46f46b54ae116005cd0918dd8f3016bd

                  SHA256

                  5c1cdd44a54e10b23a1307734ee325cd6b765d72c976eb70b0561c47a62fb99b

                  SHA512

                  8e82c95375a4f7f72163954b447e51cd460771e9217ac215a021cc7bdbc19db78ee6ff88eb08f71bc70081b8db55fdc9b2e0d4e7cf1050f987e85871f89d4e27

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\nsDialogs.dll
                  Filesize

                  9KB

                  MD5

                  4ccc4a742d4423f2f0ed744fd9c81f63

                  SHA1

                  704f00a1acc327fd879cf75fc90d0b8f927c36bc

                  SHA256

                  416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

                  SHA512

                  790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\nsProcess.dll
                  Filesize

                  4KB

                  MD5

                  f0438a894f3a7e01a4aae8d1b5dd0289

                  SHA1

                  b058e3fcfb7b550041da16bf10d8837024c38bf6

                  SHA256

                  30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                  SHA512

                  f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nspABB3.tmp\w7tbp.dll
                  Filesize

                  2KB

                  MD5

                  9a3031cc4cef0dba236a28eecdf0afb5

                  SHA1

                  708a76aa56f77f1b0ebc62b023163c2e0426f3ac

                  SHA256

                  53bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00

                  SHA512

                  8fddde526e7d10d77e247ea80b273beae9dde1d4112806f1f5c3e6a409247d54d8a4445ab5bdd77025a434c3d1dcfdf480dac21abbdb13a308d5eb74517fab53

                  Download Submit

                • C:\Windows\Debug\WIA\wiatrace.log
                  Filesize

                  858B

                  MD5

                  5028568a4abe1e061309cadcb085349a

                  SHA1

                  d149aa0e0ab70788456ff74c9d5459d7c00b09bf

                  SHA256

                  94fc15d540e5ffc0df6290a04c891af6f2971445f09baf0fceb369769d801884

                  SHA512

                  5256b66bdfda228195d5554b99bd9843c7f4eb53ed32edbf07c42f633555b9fb719829519d4d43060f974a4bc32054b9ec3fc9cfe36cd5a0312f373fc3b4b81f

                  Download Submit

                • C:\Windows\INF\c_media.PNF
                  Filesize

                  12KB

                  MD5

                  d6f787534eea52824abfef940379b071

                  SHA1

                  b200fb5e314de41c743ac84fc973584dee668946

                  SHA256

                  feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8

                  SHA512

                  7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca

                  Download Submit

                • C:\Windows\INF\ks.PNF
                  Filesize

                  126KB

                  MD5

                  ec10ca8954ca09f9d1e00ba48596196e

                  SHA1

                  09a3ab802cd0d47e969de65a13bb3065f70764bc

                  SHA256

                  189b48efc7b00f6d5cad6fed9d3dccd25f662ed08b1c22eb47d9f3a0b8d1912d

                  SHA512

                  7b2a568f0e379f8673914206618cd6489faecf9722cc6cff36f9bc3a0803b74bff7a59b55729c19eb9f181be745e66071ea06633730fb84feebd2e14a0b18946

                  Download Submit

                • C:\Windows\System32\CatRoot2\dberr.txt
                  Filesize

                  19KB

                  MD5

                  974a9c6d2cbf57a45caec4f80aee5de0

                  SHA1

                  cae1c72137db690a5f98d606c33a7bd932a974b4

                  SHA256

                  a8010430ebe78c6ac43371d872309a87da45471f4ae8a4e2031e3e03f9a356ea

                  SHA512

                  574cd0a026068db442e8e940ccd06c3cd5eef746eca633d5a62cdaba2c1aadd1402e73caaffd4f7a15a6e6df6e8688d86f21fca43d4542002fc827046ebe5c75

                  Download Submit

                • C:\Windows\System32\DriverStore\FileRepository\mcvidrv.inf_amd64_8f79bd544a4f6ca8\mcvidrv.PNF
                  Filesize

                  11KB

                  MD5

                  4f159f45bda527f57cea4292dbb71e69

                  SHA1

                  e3da0368b12108a5431b5f310221d1d922702a43

                  SHA256

                  e1df2bcbfb3cad7759236e0d0710c7a990e6e57aa51b5c2632d0dffd83aabdf8

                  SHA512

                  ec3df8f9e3bce0b951f282c4c454c3559bca92fdaa612bb03403ba9b2033e4507b76a034fd3d49924c3c7c35f8c899f3c758325218a76ea950aa771a44be5722

                  Download Submit

                • \??\c:\PROGRA~2\manycam\drivers\video\mcvidrv.sys
                  Filesize

                  63KB

                  MD5

                  985952356ece9d6186bfd45c4b1f95f5

                  SHA1

                  ee1e6ac086cdab7e3cb10e74ec7aa3664e4f7d9c

                  SHA256

                  5bc346808eb644ae02dd58250bcc843f8fb8f9d7479f8435473e14595066dbf9

                  SHA512

                  76d39663e57f96a76b19cedcad660a053ed03514b540f0cc79ee3a4a05a56b7fcaa2b9dd82c21fae39ed17b5a312104422b815822fc7f9207f7b68a608ee25b4

                  Download Submit

                • \??\c:\program files (x86)\manycam\drivers\video\mcvidrv.cat
                  Filesize

                  11KB

                  MD5

                  7d6edc58d5e22a83054170c35232884a

                  SHA1

                  bd0c6500496f95516702de38ec4bce6deda71581

                  SHA256

                  37ad0d2411d41f3608f15deba53cbdb69adff043e43443beb2f1cb76b4153f9e

                  SHA512

                  1dbcf7180b845a4d4159e35fb752f8a2b72f8848768eb9fe3c1c9f66d0b584a5cebee98a885e9b40eccc6da4c03b6537c8249910b72b7efb5b1185e20ac8190a

                  Download Submit

                • \??\c:\users\admin\appdata\local\temp\nspabb3.tmp\mcaudrv\MCAUDR~1.SYS
                  Filesize

                  35KB

                  MD5

                  7382e4a888a7d4333dff8a30b6850ee9

                  SHA1

                  1ffffea1c87f5d5400b2f489df48c6c46c334406

                  SHA256

                  3f63680a96438df841fd46f99da9670520ed3295176820dedc9d5c770ca659d0

                  SHA512

                  d19f20f2440c0f3c72541b6ac300894b8f91110d2a203f6d0764450e61a9a2269b83a23469dcb63a00703e9af6cf9732c4c34e4f1a0bf3174107f00de87e86cd

                  Download Submit

                • \??\c:\users\admin\appdata\local\temp\nspabb3.tmp\mcaudrv\mcaudrv_x64.cat
                  Filesize

                  8KB

                  MD5

                  c2d47c5dd31779917a7ad0c708ae2e07

                  SHA1

                  35b32b2fbe3d34b768deacf83bfd9d81abb0ffae

                  SHA256

                  529a272565ff8f1030af853ff393ac4a3d1f26542d2fb53874c5efe8cf5dfb9f

                  SHA512

                  aa1ed642b0e8989b92e48092b15b3e9b87022822d90237824e99e31f16df4152d9f522773b2355662e76a6ccc34f2a1cd356de542e02bafc0537b457f1b073a5

                  Download Submit