ManyCamSetup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ManyCamSetup.exe
Size

124.5MB
MD5

c9b082accc349f96220e94db97cb2f76
SHA1

18d7e4a8f0e8ee3403f18e544fc854465a153d1c
SHA256

f31445d1d91bec8e0ad59913808e62a3998c3156bf4d1fc1349e4464f25017bc
SHA512

dbb83beb52e91e608c74eb5cf359779ff3d7b8c9df3285bf9c0561c0229453cd512f34fa075727c124bd805c04a2c610e49457899192df66de14d5ed8ff6c1fb
SSDEEP

3145728:CBOiT+72oMmW1beioZia2yCupqVR9yfJg2wQBP4vvNR:AO57omW1beio0apURAJg9QBEvv

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll

Files

ManyCamSetup.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:40:5a:e7:b5:ed:8e:3a:ec:74:72:e6:80:e2:c1:bf
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

20-04-2023 00:00

Not After

22-02-2025 23:59

Subject

SERIALNUMBER=2024373215,CN=ManyCam ULC,OU=ManyCam,O=ManyCam ULC,L=Calgary,ST=Alberta,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#1307416c6265727461,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:4f:a8:07:1c:15:d0:dc:b2:8f:ce:e0:23:97:6f:7a:b8:fe:b5:21:d4:39:3e:ed:d9:f5:f0:58:63:0f:4f:cd
Signer

Actual PE Digest

f3:4f:a8:07:1c:15:d0:dc:b2:8f:ce:e0:23:97:6f:7a:b8:fe:b5:21:d4:39:3e:ed:d9:f5:f0:58:63:0f:4f:cd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/ManyCam/Effects/Effect Packs/Animals.mcep
.zip
Chewing cat.mcv
.zip
effect.json
images/main/15.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Dino 2.mcv
.zip
effect.json
images/main/Dino3 3D.png
.png
images/thumbnail/large.jpg
.jpg
images/thumbnail/medium.jpg
.jpg
images/thumbnail/small.jpg
.jpg
properties.json
Dino.mcv
.zip
effect.json
images/main/Dino2 3D.png
.png
images/thumbnail/large.jpg
.jpg
images/thumbnail/medium.jpg
.jpg
images/thumbnail/small.jpg
.jpg
properties.json
Dog Animated.mcv
.zip
effect.json
images/main/10.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Fainting Cat.mcv
.zip
effect.json
images/main/4.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Fish swimming.mcv
.zip
effect.json
images/main/Fish-swimming.png
.png
images/thumbnail/large.jpg
.jpg
images/thumbnail/medium.jpg
.jpg
images/thumbnail/small.jpg
.jpg
properties.json
Happy Panda.mcv
.zip
effect.json
images/main/23.gif
.gif
images/thumbnail/large.jpg
.png
images/thumbnail/medium.jpg
.png
images/thumbnail/small.jpg
.png
properties.json
Horse.mcv
.zip
Hungry Cat.mcv
.zip
Lion.mcv
.zip
Panda Animated.mcv
.zip
Pig Animated.mcv
.zip
Rabbit.mcv
.zip
Royal Corgi.mcv
.zip
Serenade Cat.mcv
.zip
Shark.mcv
.zip
Sleeping Panda.mcv
.zip
Walking Cat.mcv
.zip
effect_pack_info.json
$APPDATA/ManyCam/Effects/Effect Packs/Borders.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Distortions.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Education.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Emojis.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FaceAccessories.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FaceMasks.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Filters.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/FoodsAndBeverages.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Groups.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/LowerThirds.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Objects.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Overlays.mcep
.zip
$APPDATA/ManyCam/Effects/Effect Packs/Sports.mcep
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-01.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-02.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-03.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-04.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-05.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-06.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-07.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-08.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-09.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-10.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-11.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-12.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-13.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-14.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-15.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-16.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-17.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-18.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-19.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-20.mclt2
.zip
$APPDATA/ManyCam/LowerThirds/lower-third-21.mclt2
.zip
$APPDATA/ManyCam/Stamps/chat.mbr
.zip
$APPDATA/ManyCam/Stamps/flash.mbr
.zip
$APPDATA/ManyCam/Stamps/heart.mbr
.zip
$APPDATA/ManyCam/Stamps/leafs.mbr
.zip
$APPDATA/ManyCam/Stamps/like.mbr
.zip
$APPDATA/ManyCam/Stamps/music.mbr
.zip
$APPDATA/ManyCam/Stamps/star.mbr
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Animals.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Borders.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Distortions.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Education.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Emojis.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FaceAccessories.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FaceMasks.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Filters.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/FoodsAndBeverages.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Groups.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/LowerThirds.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Objects.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Overlays.mcep
.zip
$APPDATA/ManyCam/UserAppData/Effects/Effect Packs/Sports.mcep
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-01.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-02.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-03.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-04.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-05.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-06.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-07.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-08.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-09.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-10.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-11.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-12.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-13.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-14.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-15.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-16.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-17.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-18.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-19.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-20.mclt2
.zip
$APPDATA/ManyCam/UserAppData/LowerThirds/lower-third-21.mclt2
.zip
$APPDATA/ManyCam/UserAppData/Stamps/chat.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/flash.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/heart.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/leafs.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/like.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/music.mbr
.zip
$APPDATA/ManyCam/UserAppData/Stamps/star.mbr
.zip
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

1fe003b76229a0ffee4a9219893de38e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExW
lstrcmpiW
GetCurrentThreadId
GetProcAddress
GetCommandLineW
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
SetEvent
SetLastError
SetCurrentDirectoryW
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetExitCodeThread
CreateThread
CreateFileMappingW
CreateEventW
lstrlenW
GlobalAlloc
CreateProcessW
GetLastError
FormatMessageW
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
DuplicateHandle
LoadLibraryA

user32

SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
DefWindowProcW
PostMessageW
SetForegroundWindow
CreateWindowExW
GetWindowThreadProcessId
CallWindowProcW
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClassNameW
CallNextHookEx
CharNextW
DialogBoxParamW
MessageBoxW
EndDialog
SetWindowLongW
LoadImageW
GetWindowLongW
EnableWindow
ShowWindow
wsprintfW
LoadStringW
GetDlgItem
SendMessageW
DestroyWindow

advapi32

GetUserNameW
OpenSCManagerW
GetTokenInformation
OpenProcessToken
FreeSid
CloseServiceHandle
EqualSid
AllocateAndInitializeSid
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
QueryServiceStatus
OpenServiceW

shell32

ShellExecuteExW

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 894B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:5 windows x86 arch:x86

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 753B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

735e27ae3d7df8c0487e4353d04f6f28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LocalFree
WideCharToMultiByte
TerminateThread
lstrcpyW
LoadLibraryA
CreateThread
WaitForSingleObject
LocalAlloc
lstrcpynW
SleepEx
MulDiv
GetModuleHandleW
ReadFile
GetLastError
CreateFileW
lstrcmpiW
CreateFileA
lstrcatW
GetFileSize
SetFilePointer
lstrcmpW
MultiByteToWideChar
lstrlenA
WriteFile
lstrlenW
CloseHandle
GlobalAlloc
GlobalFree
GetTickCount
DeleteFileW

user32

GetDlgItem
DestroyWindow
GetClientRect
MessageBoxW
wsprintfA
SystemParametersInfoW
GetWindowTextW
GetWindowLongW
FindWindowExW
IsWindow
CreateDialogParamW
GetParent
ShowWindow
KillTimer
DispatchMessageW
LoadIconW
PostMessageW
IsDialogMessageW
GetMessageW
SetWindowPos
SendDlgItemMessageW
SetWindowTextW
TranslateMessage
GetWindowRect
RedrawWindow
SetTimer
EnableWindow
UpdateWindow
SetWindowLongW
wsprintfW
SendMessageW
SetDlgItemTextW
IsWindowVisible

comctl32

ord17

wininet

InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetErrorDlg
HttpSendRequestExW
InternetWriteFile
HttpSendRequestW
InternetSetFilePointer
HttpAddRequestHeadersA
FtpCreateDirectoryW
InternetCrackUrlW
FtpOpenFileW
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpEndRequestW
InternetReadFile
HttpAddRequestHeadersW
InternetCloseHandle
HttpQueryInfoW

Exports

Exports

get
head
post
put

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/mdsu.exe
.exe windows:6 windows x64 arch:x64

a3cf5b7db5bb1be9f0531da9a8015cab

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18-02-2019 00:00

Not After

28-02-2022 23:59

Subject

SERIALNUMBER=1145963121,CN=ManyCam (VISICOM MÉDIA INC.),O=ManyCam (VISICOM MÉDIA INC.),L=Brossard,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130842726f7373617264,1.3.6.1.4.1.311.60.2.1.2=#1306517565626563,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

Actual PE Digest

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\work\projects\manycam\win_git\prebuild\driver_setup_utility\!out\x64\mdsu_x64.pdb

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
LocalFree
FormatMessageW
FileTimeToSystemTime
CloseHandle
WriteConsoleW
SetFilePointerEx
OutputDebugStringW
GetConsoleMode
GetConsoleCP
LoadLibraryW
lstrlenW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
GetLastError
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDateFormatW
FindClose
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStartupInfoW
GetFileType
GetStdHandle
FatalAppExitA
DeleteCriticalSection
GetCurrentThreadId
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
GetACP
CreateFileW
IsValidCodePage
IsDebuggerPresent
HeapSize
WideCharToMultiByte
MultiByteToWideChar
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc

user32

LoadStringW
CharNextW
BroadcastSystemMessageW
CharPrevW

advapi32

RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegCloseKey
InitiateSystemShutdownExW

ole32

CLSIDFromString

setupapi

CM_Disconnect_Machine
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Free_Log_Conf_Handle
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW

Exports

Exports

mdsu_add_device
mdsu_list_devices
mdsu_remove_all
mdsu_remove_device
mdsu_rename_device

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/video/mdsu.exe
.exe windows:6 windows x64 arch:x64

a3cf5b7db5bb1be9f0531da9a8015cab

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18-02-2019 00:00

Not After

28-02-2022 23:59

Subject

SERIALNUMBER=1145963121,CN=ManyCam (VISICOM MÉDIA INC.),O=ManyCam (VISICOM MÉDIA INC.),L=Brossard,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130842726f7373617264,1.3.6.1.4.1.311.60.2.1.2=#1306517565626563,1.3.6.1.4.1.311.60.2.1.3=#13024341

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

Actual PE Digest

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\data\work\projects\manycam\win_git\prebuild\driver_setup_utility\!out\x64\mdsu_x64.pdb

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
LocalFree
FormatMessageW
FileTimeToSystemTime
CloseHandle
WriteConsoleW
SetFilePointerEx
OutputDebugStringW
GetConsoleMode
GetConsoleCP
LoadLibraryW
lstrlenW
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
GetLastError
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
GetDateFormatW
FindClose
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
CreateSemaphoreW
GetModuleHandleW
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetProcessHeap
SetStdHandle
GetStringTypeW
GetStartupInfoW
GetFileType
GetStdHandle
FatalAppExitA
DeleteCriticalSection
GetCurrentThreadId
GetCurrentThread
SetLastError
GetCPInfo
GetOEMCP
GetACP
CreateFileW
IsValidCodePage
IsDebuggerPresent
HeapSize
WideCharToMultiByte
MultiByteToWideChar
AreFileApisANSI
GetModuleHandleExW
ExitProcess
HeapFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc

user32

LoadStringW
CharNextW
BroadcastSystemMessageW
CharPrevW

advapi32

RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegDeleteValueW
RegCloseKey
InitiateSystemShutdownExW

ole32

CLSIDFromString

setupapi

CM_Disconnect_Machine
SetupCopyOEMInfW
SetupDiCreateDeviceInfoList
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Free_Log_Conf_Handle
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiOpenClassRegKeyExW
SetupDiCallClassInstaller
SetupDiGetClassDescriptionExW
SetupDiBuildClassInfoListExW
SetupDiGetINFClassW
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiGetDeviceInfoListDetailW

shlwapi

PathFindFileNameW
PathRemoveFileSpecW

Exports

Exports

mdsu_add_device
mdsu_list_devices
mdsu_remove_all
mdsu_remove_device
mdsu_rename_device

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:40:5a:e7:b5:ed:8e:3a:ec:74:72:e6:80:e2:c1:bfCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f3:4f:a8:07:1c:15:d0:dc:b2:8f:ce:e0:23:97:6f:7a:b8:fe:b5:21:d4:39:3e:ed:d9:f5:f0:58:63:0f:4f:cdSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.5MB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

1fe003b76229a0ffee4a9219893de38e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1024B - Virtual size: 894B

45d25ca52c312b2254c60dbcb30342d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:40:5a:e7:b5:ed:8e:3a:ec:74:72:e6:80:e2:c1:bf
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f3:4f:a8:07:1c:15:d0:dc:b2:8f:ce:e0:23:97:6f:7a:b8:fe:b5:21:d4:39:3e:ed:d9:f5:f0:58:63:0f:4f:cd
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.5MB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1024B - Virtual size: 894B

.text
Size: 1024B - Virtual size: 686B

.rdata
Size: 1024B - Virtual size: 753B

.data
Size: 512B - Virtual size: 48B

.reloc
Size: 512B - Virtual size: 240B

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

6f:cf:f9:6e:80:8b:df:bf:90:e8:2d:ce:d0:ad:a8:2c
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

bc:bf:29:e6:06:9e:35:19:c5:36:5d:af:28:58:ac:55:fe:e7:7c:ee:d3:fe:10:ec:0f:ee:9c:a9:b6:43:5c:b9
Signer

.text
Size: 208KB - Virtual size: 208KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 8KB - Virtual size: 21KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 44KB - Virtual size: 44KB

.reloc
Size: 3KB - Virtual size: 2KB