Overview

overview

9

Static

static

1

M_a_n_y_C_...__.zip

windows10-2004-x64

9

M_a_n_y_C_...__.zip

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    404s
  • max time network
    406s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/09/2026, 04:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__.zip
  • Size 126.7MB
  • Sample260905-ev8qssem5v
  • SHA256 3cbe68e62053f969a61528689ac60ba8730b17b696284a2d698290f945d220cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 8 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 33 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__.zip
    1⤵
      PID:3136
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1772
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4600
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\" -ad -an -ai#7zMap5337:246:7zEvent15771
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:712
      • C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\ManyCamSetup.exe
        "C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\ManyCamSetup.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1572
          2⤵
          • Program crash
          PID:756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1840 -ip 1840
        1⤵
          PID:3440
        • C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\ManyCamSetup.exe
          "C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\ManyCamSetup.exe"
          1⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall delete rule name="ManyCam Virtual Webcam"
            2⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2852
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="ManyCam Virtual Webcam" dir=in action=allow program="C:\Program Files (x86)\ManyCam\ManyCam.exe" enable=yes profile=domain,private,public
            2⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3284
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall set rule name="ManyCam Virtual Webcam" new enable=yes
            2⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3412
          • C:\Windows\SYSTEM32\pnputil.exe
            pnputil.exe /enum-drivers
            2⤵
              PID:4532
            • C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe
              "C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe" remove_all_video_devices
              2⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:2516
            • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
              "C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe" add_by_name "ManyCam Virtual Webcam"
              2⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:3028
            • C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe
              "C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe" remove ManyCamAudio
              2⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5028
            • C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe
              "C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe" install "C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mcaudrv\mcaudrv_x64.inf" ManyCamAudio
              2⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:4972
            • C:\ProgramData\ManyCam\Service\ManyCamService.exe
              "C:\ProgramData\ManyCam\Service\ManyCamService.exe" install
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2204
            • C:\ProgramData\ManyCam\Service\ManyCamService.exe
              "C:\ProgramData\ManyCam\Service\ManyCamService.exe" start
              2⤵
              • Executes dropped EXE
              PID:1792
            • C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\PaltalkSetup.exe
              "C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\PaltalkSetup.exe" /S /NORUNAFTERINSTALL /NORUNONSTARTUP /advc=5101 /refc=113355 /DW /DAC
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:404
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 808
                3⤵
                • Program crash
                PID:4284
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 816
                3⤵
                • Program crash
                PID:4076
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1172
                3⤵
                • Program crash
                PID:4576
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1768
                3⤵
                • Program crash
                PID:3800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1916
                3⤵
                • Program crash
                PID:3272
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1908
                3⤵
                • Program crash
                PID:4768
            • C:\Program Files (x86)\ManyCam\ManyCam.exe
              "C:\Program Files (x86)\ManyCam\ManyCam.exe" --language en
              2⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:592
              • C:\Program Files (x86)\ManyCam\CrashSender1402.exe
                "C:\Program Files (x86)\ManyCam\CrashSender1402.exe" "fd67e6f5-2973-4064-98a0-ecc9c9c199fe-tmp"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2864
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:212
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2f42bc42-7f96-ca42-9077-0ab73645e9f1}\mcvidrv.inf" "9" "4b6092e43" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\manycam\drivers\video"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:2932
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\IMAGE\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:79f41c50f9c9ad7b:ManyCam.Device:8.0.21.0:manycam," "4b6092e43" "0000000000000138"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:4948
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8ddebb33-485e-a942-bedd-f1db54abd760}\mcaudrv_x64.inf" "9" "4ea6deb4b" "00000000000000E8" "WinSta0\Default" "00000000000000B8" "208" "c:\users\admin\appdata\local\temp\nsdecc5.tmp\mcaudrv"
              2⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:1580
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{dd054946-9afe-4045-956e-5034741f16c5} Global\{5ec30de7-232d-894e-8c74-ae8ce264f97f} C:\Windows\System32\DriverStore\Temp\{6e6d1b44-b0b0-fc41-81bd-4241d3f5b624}\mcaudrv_x64.inf C:\Windows\System32\DriverStore\Temp\{6e6d1b44-b0b0-fc41-81bd-4241d3f5b624}\mcaudrv_x64.cat
                3⤵
                  PID:4484
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca1116c38308:mcaudrv_Simple:4.1.0.0:manycamaudio," "4ea6deb4b" "00000000000000E8"
                2⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:2828
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
              1⤵
                PID:4728
              • C:\ProgramData\ManyCam\Service\ManyCamService.exe
                C:\ProgramData\ManyCam\Service\ManyCamService.exe
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2776
                • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
                  "C:/Program Files (x86)/ManyCam/drivers/video/mdsu.exe" list_all_video_devices
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:3960
                • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
                  "C:/Program Files (x86)/ManyCam/drivers/video/mdsu.exe" list_all_video_devices
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:2816
                • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
                  "C:/Program Files (x86)/ManyCam/drivers/video/mdsu.exe" list_all_video_devices
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:4564
                • C:\Program Files (x86)\ManyCam\drivers\video\mdsu.exe
                  "C:/Program Files (x86)/ManyCam/drivers/video/mdsu.exe" list_all_video_devices
                  2⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:2008
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 404 -ip 404
                1⤵
                  PID:3340
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 404 -ip 404
                  1⤵
                    PID:4492
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 404 -ip 404
                    1⤵
                      PID:4028
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 404 -ip 404
                      1⤵
                        PID:2864
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 404 -ip 404
                        1⤵
                          PID:4948
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 404 -ip 404
                          1⤵
                            PID:2456
                          • C:\Program Files (x86)\ManyCam\ManyCam.exe
                            "C:\Program Files (x86)\ManyCam\ManyCam.exe" --silent
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Loads dropped DLL
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1792
                            • C:\Program Files (x86)\ManyCam\CrashSender1402.exe
                              "C:\Program Files (x86)\ManyCam\CrashSender1402.exe" "ba824471-031f-421c-95ec-e9e3a5e729ae-tmp"
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2632
                          • C:\Windows\system32\AUDIODG.EXE
                            C:\Windows\system32\AUDIODG.EXE 0x52c 0x540
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2852
                          • C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe
                            "C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2220
                          • C:\Program Files (x86)\ManyCam\ManyCam.exe
                            "C:\Program Files (x86)\ManyCam\ManyCam.exe"
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1748
                            • C:\Program Files (x86)\ManyCam\CrashSender1402.exe
                              "C:\Program Files (x86)\ManyCam\CrashSender1402.exe" "ccf232fe-69f8-4b4a-9e68-b0d154ee8a25-tmp"
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2928
                          • C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe
                            "C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1608
                          • C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe
                            "C:\Users\Admin\Desktop\M_a_n_y_C_a_m___9_._1_._0_._5___M_u_l_t_i_l_i_n_g_u_a_l_____d_e_o_r_i_n_g___c_o_m__\ManyCam 9.1.0.5 Multilingual\Loader\Loader.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4652

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Event Triggered Execution

                                2
                                T1546

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Netsh Helper DLL

                                1
                                T1546.007

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Event Triggered Execution

                                2
                                T1546

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Netsh Helper DLL

                                1
                                T1546.007

                                Defense Evasion

                                Impair Defenses

                                1
                                T1562

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Modify Registry

                                2
                                T1112

                                Subvert Trust Controls

                                2
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                SIP and Trust Provider Hijacking

                                1
                                T1553.003

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Discovery

                                Peripheral Device Discovery

                                1
                                T1120

                                Query Registry

                                6
                                T1012

                                System Information Discovery

                                4
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                ManyCam.exe
                                • Path C:\Program Files (x86)\ManyCam\ManyCam.exe
                                • Size 23.4MB
                                • SHA256 5b7f996b18bf1e335fe13953706b2f0e07ce05b082cfd83b7dc1b966fbcbe29e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mcvidrv.inf
                                • Path C:\Program Files (x86)\ManyCam\drivers\video\mcvidrv.inf
                                • Size 4KB
                                • SHA256 5d6b10534c4b717cb3969a0bf07692e0662b629c61b8f25fd16f5671ae7d1385
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ManyCamService.exe
                                • Path C:\ProgramData\ManyCam\Service\ManyCamService.exe
                                • Size 532KB
                                • SHA256 f2ce20e7019c029388a24326b149b0fbf17649f2ba805c96e9f6fb27eb4cb3cd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                haarcascade_frontalface_alt.xml
                                • Path C:\Users\Admin\AppData\Local\ManyCam\cv\haarcascade_frontalface_alt.xml
                                • Size 684KB
                                • SHA256 69366fedc30de8cbd403364c74301c1390edc0dc5f972b06686a2c009548dd1b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                haarcascade_lefteye_2splits.xml
                                • Path C:\Users\Admin\AppData\Local\ManyCam\cv\haarcascade_lefteye_2splits.xml
                                • Size 198KB
                                • SHA256 04c6533222873c2fa9d75cca34b687e5db5985ceae616900f1355b4c32faa4ea
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                haarcascade_righteye_2splits.xml
                                • Path C:\Users\Admin\AppData\Local\ManyCam\cv\haarcascade_righteye_2splits.xml
                                • Size 198KB
                                • SHA256 7db2cde2a3fab5200e9752d03e1dce1f5f3a48960106a88a4d43fb4109258801
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                uninstall.exe
                                • Path C:\Users\Admin\AppData\Local\Paltalk\uninstall.exe
                                • Size 483KB
                                • SHA256 63ea533e960d9172c88497a7b350d6f72794d3c9fdc54820cfa08aa75bcad276
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ManyCam.EhZSSd
                                • Path C:\Users\Admin\AppData\Local\Temp\ManyCam.EhZSSd
                                • Size 752KB
                                • SHA256 ba1c08ec9271abd74309bf19e8a80fdc30b230377edfe15818d327bbd1514aef
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                System.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsd9435.tmp\System.dll
                                • Size 11KB
                                • SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UAC.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsd9435.tmp\UAC.dll
                                • Size 13KB
                                • SHA256 eb80dc6d72e39c829aa2e7370acde86b4bdcc416b65bacb970c4be9ca7928b98
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                UserInfo.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsd9435.tmp\UserInfo.dll
                                • Size 4KB
                                • SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                inetc.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsd9435.tmp\inetc.dll
                                • Size 24KB
                                • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                nsDialogs.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsd9435.tmp\nsDialogs.dll
                                • Size 9KB
                                • SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                AccessControl.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\AccessControl.dll
                                • Size 15KB
                                • SHA256 3948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ExecDos.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\ExecDos.dll
                                • Size 6KB
                                • SHA256 91d5481f576382164703e4ac244052265769377838ac30233ad79c983ed9d454
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                InstallerAssistant.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\InstallerAssistant.dll
                                • Size 977KB
                                • SHA256 502de1cba283dfaaa80635add4cfbd6d10f896a96ded55325343e5be168851b0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                bg_logo.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\bg_logo.bmp
                                • Size 86KB
                                • SHA256 703c2f401c19a7ecc85117d7c03f8e87cbdf1c0b20bb2d071df2a8bb5ce375af
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                bg_main.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\bg_main.bmp
                                • Size 269KB
                                • SHA256 1c6345bc1581c73dc0879718c00b56659ac3efc7ad6098dc776f54f21936daac
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                bottomLine.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\bottomLine.bmp
                                • Size 70B
                                • SHA256 436bf0b8faf8a972bd2d909df4b503ededd5c65db8da89c7ac6ca441a9498a8b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                us.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\flags\us.bmp
                                • Size 582B
                                • SHA256 2fbbcd3b179f224a96398f8dbe4cacaf6ddaa7901eb96966fae31fc84a9708ca
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                mcaudrv_x64.inf
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mcaudrv\mcaudrv_x64.inf
                                • Size 4KB
                                • SHA256 0f15b959f3a05c04b6941c11b518c01e444853f4f8b351d7486ac82e677a85ea
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mdsu.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\mdsu.exe
                                • Size 353KB
                                • SHA256 5c1cdd44a54e10b23a1307734ee325cd6b765d72c976eb70b0561c47a62fb99b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                modern-header.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\modern-header.bmp
                                • Size 25KB
                                • SHA256 c4dc2125f3d41a633efe26bea56b63d1ca5ce432b81bb8cfd82a8fd408ada965
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                nsProcess.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\nsProcess.dll
                                • Size 4KB
                                • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                paltalk_offer_page_ui.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\paltalk_offer_page_ui.bmp
                                • Size 261KB
                                • SHA256 c47da425862e885cbf12e19ffe7db27eba3ee9b81dd07cf228042bb8c437de5f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                w7tbp.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsdECC5.tmp\w7tbp.dll
                                • Size 2KB
                                • SHA256 53bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                InstallerAssistant.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsr4DDA.tmp\InstallerAssistant.dll
                                • Size 541KB
                                • SHA256 ce3cea6db19bf881d3522aaeb9b9cf43c153025a67b7307675a67e96b0ba9770
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                paltalk.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\nsr4DDA.tmp\paltalk.dll
                                • Size 330KB
                                • SHA256 929591f61678faacf88b5a57d4360fbd49f44b0d18029fedf9fe5849dd936342
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wiatrace.log
                                • Path C:\Windows\Debug\WIA\wiatrace.log
                                • Size 857B
                                • SHA256 fa157bd8bdd72451423542b426e76529641645c06247192d3221babbd0b19927
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                c_media.PNF
                                • Path C:\Windows\INF\c_media.PNF
                                • Size 12KB
                                • SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ks.PNF
                                • Path C:\Windows\INF\ks.PNF
                                • Size 126KB
                                • SHA256 db67aaaf29c9451491d151abe4090e1a046afc4edf011eeeb8802b9a54b003c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dberr.txt
                                • Path C:\Windows\System32\CatRoot2\dberr.txt
                                • Size 37KB
                                • SHA256 038e98af7b23247c3026a2eabd6a7d728ce523c2eea962f890635d25dda56e05
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mcvidrv.PNF
                                • Path C:\Windows\System32\DriverStore\FileRepository\mcvidrv.inf_amd64_8f79bd544a4f6ca8\mcvidrv.PNF
                                • Size 11KB
                                • SHA256 e1df2bcbfb3cad7759236e0d0710c7a990e6e57aa51b5c2632d0dffd83aabdf8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mcvidrv.sys
                                • Path \??\c:\PROGRA~2\manycam\drivers\video\mcvidrv.sys
                                • Size 63KB
                                • SHA256 5bc346808eb644ae02dd58250bcc843f8fb8f9d7479f8435473e14595066dbf9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mcvidrv.cat
                                • Path \??\c:\program files (x86)\manycam\drivers\video\mcvidrv.cat
                                • Size 11KB
                                • SHA256 37ad0d2411d41f3608f15deba53cbdb69adff043e43443beb2f1cb76b4153f9e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MCAUDR~1.SYS
                                • Path \??\c:\users\admin\appdata\local\temp\nsdecc5.tmp\mcaudrv\MCAUDR~1.SYS
                                • Size 35KB
                                • SHA256 3f63680a96438df841fd46f99da9670520ed3295176820dedc9d5c770ca659d0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mcaudrv_x64.cat
                                • Path \??\c:\users\admin\appdata\local\temp\nsdecc5.tmp\mcaudrv\mcaudrv_x64.cat
                                • Size 8KB
                                • SHA256 529a272565ff8f1030af853ff393ac4a3d1f26542d2fb53874c5efe8cf5dfb9f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/592-1466-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1608-1504-0x0000000000400000-0x0000000000407000-memory.dmp
                                Download

                                memory/1748-1508-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1748-1503-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1748-1507-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1748-1506-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1748-1505-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1748-1509-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1279-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1467-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1468-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1475-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1479-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/1792-1489-0x00000000002B0000-0x00000000036B2000-memory.dmp
                                Download

                                memory/2220-1490-0x0000000000400000-0x0000000000407000-memory.dmp
                                Download

                                memory/4600-11-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-1-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-2-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-8-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-12-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-6-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-0-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-10-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-9-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download

                                memory/4600-7-0x0000023CC4C80000-0x0000023CC4C81000-memory.dmp
                                Download