File name:

CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe

Full analysis: https://app.any.run/tasks/070c7212-feb7-4268-bda0-8fdce8851094
Verdict: Malicious activity
Analysis date: November 12, 2024, 16:17:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

AB97274DFA0C17CC4BA0B7EED0301C84

SHA1:

DCD52422C474CA74F1F142D3CBE61420D0F54FD2

SHA256:

566321110E78480726F6AF1084A3BA900F5F49E57DE340E56F920D2139F9694A

SSDEEP:

98304:UtCWkQ+UrQh8YYLTZpCC/lL2HdfnoyVHiUpi9d52DGwsqv6lwYSXxKr2LF9Oo6SK:lMo9aqRm4ncaa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • IS.exe (PID: 7092)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 5792)

    • Executable content was dropped or overwritten

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 5792)
      • IS.exe (PID: 7092)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 6028)
      • regedit.exe (PID: 1248)
      • regedit.exe (PID: 5264)
      • cmd.exe (PID: 6148)
      • regedit.exe (PID: 6408)
      • cmd.exe (PID: 3832)
      • regedit.exe (PID: 6568)
      • cmd.exe (PID: 2724)
      • regedit.exe (PID: 3944)
      • cmd.exe (PID: 2464)
      • regedit.exe (PID: 1048)
      • cmd.exe (PID: 7044)
      • regedit.exe (PID: 2980)
      • regedit.exe (PID: 6540)
      • cmd.exe (PID: 2632)
      • regedit.exe (PID: 6480)
      • regedit.exe (PID: 6272)
      • regedit.exe (PID: 1176)
      • cmd.exe (PID: 6352)
      • regedit.exe (PID: 6408)
      • regedit.exe (PID: 3932)
      • cmd.exe (PID: 4040)
      • regedit.exe (PID: 1840)
      • regedit.exe (PID: 3864)
      • cmd.exe (PID: 6756)
      • regedit.exe (PID: 1764)
      • regedit.exe (PID: 6784)
      • regedit.exe (PID: 5756)
      • cmd.exe (PID: 6236)
      • regedit.exe (PID: 3508)
      • regedit.exe (PID: 2576)
      • regedit.exe (PID: 6176)
      • regedit.exe (PID: 6568)

    • Starts CMD.EXE for commands execution

      • ExecuteBatch-Win.exe (PID: 4076)
      • ExecuteBatch-Win.exe (PID: 7004)
      • ExecuteBatch-Win.exe (PID: 6612)
      • ExecuteBatch-Win.exe (PID: 6028)
      • ExecuteBatch-Win.exe (PID: 6448)
      • ExecuteBatch-Win.exe (PID: 7036)
      • ExecuteBatch-Win.exe (PID: 1252)
      • ExecuteBatch-Win.exe (PID: 2620)
      • ExecuteBatch-Win.exe (PID: 6432)
      • ExecuteBatch-Win.exe (PID: 6740)
      • ExecuteBatch-Win.exe (PID: 1788)

    • The process deletes folder without confirmation

      • ExecuteBatch-Win.exe (PID: 4076)
      • ExecuteBatch-Win.exe (PID: 7004)
      • ExecuteBatch-Win.exe (PID: 6612)
      • ExecuteBatch-Win.exe (PID: 6028)
      • ExecuteBatch-Win.exe (PID: 6448)
      • ExecuteBatch-Win.exe (PID: 7036)
      • ExecuteBatch-Win.exe (PID: 1252)
      • ExecuteBatch-Win.exe (PID: 2620)
      • ExecuteBatch-Win.exe (PID: 6740)
      • ExecuteBatch-Win.exe (PID: 6432)
      • ExecuteBatch-Win.exe (PID: 1788)

    • Executes as Windows Service

      • XYNTService.exe (PID: 1204)
      • VSSVC.exe (PID: 5976)
      • XYNTService.exe (PID: 6128)
      • XYNTService.exe (PID: 6236)
      • XYNTService.exe (PID: 6440)
      • XYNTService.exe (PID: 1280)
      • XYNTService.exe (PID: 3600)
      • XYNTService.exe (PID: 4228)
      • XYNTService.exe (PID: 6500)
      • XYNTService.exe (PID: 3932)
      • XYNTService.exe (PID: 6028)
      • XYNTService.exe (PID: 3600)
      • XYNTService.exe (PID: 6532)

    • Process drops legitimate windows executable

      • IS.exe (PID: 7092)

    • The process drops C-runtime libraries

      • IS.exe (PID: 7092)

    • Uses REG/REGEDIT.EXE to modify registry

      • SMIRegistryTool.exe (PID: 6756)

  • INFO

    • Reads the computer name

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 5792)

    • Sends debugging messages

      • setup.exe (PID: 7112)
      • MPTool.exe (PID: 1792)
      • CheckVcamReg.exe (PID: 6088)

    • Checks supported languages

      • CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe (PID: 5792)

    • The process uses the downloaded file

      • setup.exe (PID: 7112)
      • SMIServiceWrapper.exe (PID: 6184)
      • SMIServiceWrapper.exe (PID: 4376)

    • Create files in a temporary directory

      • IS.exe (PID: 7092)
      • XYNTService.exe (PID: 2484)

    • Manages system restore points

      • SrTasks.exe (PID: 6176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:10:17 19:35:08+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 77824
InitializedDataSize: 139264
UninitializedDataSize: -
EntryPoint: 0xedb2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.1.12
ProductVersionNumber: 1.3.1.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: -
FileVersion: 1.3.1.12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
322
Monitored processes
201
Malicious processes
2
Suspicious processes
5

Behavior graph

Click at the process to see the details
start camera_smi_w72_a05_setup-94rr4_zpe.exe setup.exe is.exe isbew64.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs executebatch-win.exe no specs executebatch-win.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs mptool.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs executebatch-win.exe no specs checkvcamreg.exe smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs xyntservice.exe no specs regedit.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs executebatch-win.exe no specs cmd.exe no specs conhost.exe no specs smiservicewrapper.exe no specs regedit.exe no specs regedit.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs smiservicewrapper.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs conhost.exe no specs xyntservice.exe no specs smiregistrytool.exe no specs regedit.exe no specs regedit.exe no specs SPPSurrogate no specs camera_smi_w72_a05_setup-94rr4_zpe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\Users\admin\AppData\Local\Temp\CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe" C:\Users\admin\AppData\Local\Temp\CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.3.1.12
Modules
Images
c:\users\admin\appdata\local\temp\camera_smi_w72_a05_setup-94rr4_zpe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
204"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe" -u C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
824\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XYNTService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
824SMIServiceWrapper.exe -i SMIRegistryTool.exeC:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\SMIServiceWrapper.exe—IS.exe
User:
admin
Company:
TODO: <公司名稱>
Integrity Level:
HIGH
Description:
TODO: <檔案說明>
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\smiservicewrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
884"C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe" -u C:\Program Files (x86)\SMI\Virtual Webcam\DriverPackage\XYNTService.exe—SMIServiceWrapper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\smi\virtual webcam\driverpackage\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XYNTService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1048"C:\Windows\System32\regedit.exe" /e:a "C:\Users\Public\Documents\SMI\Virtual WebCam\DriverPackage\{ADCF9E5F-B7CB-43ED-8003-21FA8E98D1E5}.reg" "HKEY_CLASSES_ROOT\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\0 Laptop_Integrated_Webcam_5M"C:\Windows\SysWOW64\regedit.exe—ExecuteBatch-Win.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1176"C:\Windows\System32\regedit.exe" /e:a "C:\Users\Public\Documents\SMI\Virtual WebCam\DriverPackage\{5543FABC-B4B2-4408-8DFA-9209D51B9AA9}.reg" "HKEY_CLASSES_ROOT\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\1 Laptop_Integrated_Webcam_HD"C:\Windows\SysWOW64\regedit.exe—ExecuteBatch-Win.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1204C:\Users\admin\AppData\Local\Temp\{31CC7596-C282-404B-A864-FCD591D62E01}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exeC:\Users\admin\AppData\Local\Temp\{31CC7596-C282-404B-A864-FCD591D62E01}\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}\XYNTService.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{31cc7596-c282-404b-a864-fcd591d62e01}\{fe7ad27a-62b1-44f6-b69c-25d1eca94f5d}\xyntservice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
14 901
Read events
14 645
Write events
235
Delete events
21

Modification events

(PID) Process:(7092) IS.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000004C7F6711E35DB01B41B0000A41B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
480000000000000004C7F6711E35DB01741A0000140F0000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000E51937721E35DB01741A0000140F0000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
4800000000000000C67E39721E35DB01741A0000140F0000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000C67E39721E35DB01741A0000140F0000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000870C43721E35DB01741A0000140F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
480000000000000000C2B0721E35DB01741A0000140F0000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6772) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000005B76B5721E35DB01741A00000C170000E803000001000000000000000000000031AED67D47D5C247A2E4C08325912DB600000000000000000000000000000000
(PID) Process:(5976) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000008704BF721E35DB0158170000481A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
89
Suspicious files
27
Text files
57
Unknown types
1

Dropped files

PID
Process
Filename
Type
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data1.cab —
MD5:—
SHA256:—
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\data2.cabcompressed
MD5:248EB0EA917B7D5AB68F811865C6459B
SHA256:EE7CE988DA80D07BD54CD2F6158B4C72A3DA662EBCE0E5875049927655003D46
7092IS.exeC:\Users\admin\AppData\Local\Temp\{E71975BA-3367-4062-87E3-51D3E7D8FEAF}\_Setup.dllexecutable
MD5:7DE2D19C870587B8FFC5A446E9B6E29A
SHA256:35EEF33D1890A6E34D647F86F24C730B4F741C9D33FCCE01CFB12D2B8E55B5D1
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\IS.exeexecutable
MD5:443FC0A0C449097D333CFED5DDFEF06F
SHA256:B44F5CC56CD948D0233E5D3B4D432F5A03FB90DC9407C5AD418EC97DDDDE1E5F
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.initext
MD5:BFB8C63B75994E9DF511DE062C9773EA
SHA256:59BC3437FCBAC28C487D59B6FA0D928A0AD597E90F60AB8E69B6440669DEEAAF
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.issbinary
MD5:C2ED7195993A9D2785E766B36778E9B1
SHA256:AF925E040C2516A694C2339F5715EB55A6709C4E51C38106602770AEE1FFF97C
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\Version.txttext
MD5:E9C215228416125801A367A81F4D10D8
SHA256:3F45FAFA7DAD728F616137BC87E97DE5B7CC301B7914DFDCDBA1576393B8BF8E
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.inxbinary
MD5:14D5453E87B3E181BFFDA442FC14EF3F
SHA256:00D77317D59C21A7639CCF187FB60B95D594731FE2AE84055BC61E8D5456DE05
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\SilentSetup.battext
MD5:173A04C8C96F2EA2B87B8512C8A1ACDD
SHA256:9EE167F680D9794576B62916DA84E5CB778AAF6AFE756263AE0D21D970A9DD03
5792CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exeC:\Dell\Drivers\94RR4\setup.exeexecutable
MD5:B633E0F7C3FEFF673F6E755877B009FE
SHA256:6A0FC35DC530FFEBD16FB7A47525DBC837DF1FC187E25459BD4B116DEC2A969F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
16
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.12
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 184.86.251.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
self.events.data.microsoft.com
  • 20.42.73.24
whitelisted

Threats

No threats detected
Process
Message
setup.exe
Open reg key fail in WOW64 platform (2)
setup.exe
i=0 setup.exe"
setup.exe
Exe=c:\dell\drivers\94rr4\IS.exe
setup.exe
ROUND <1> ID =7092
MPTool.exe
m_vecVID[1]=090c m_vecPID[1]=037d
MPTool.exe
m_vecVID[0]=090c m_vecPID[0]=037c
MPTool.exe
strParam=-s
MPTool.exe
ScanUSBProc--end
CheckVcamReg.exe
CheckVcamRegIsExist
CheckVcamReg.exe
CheckSourceFilterRegistry Fail , No Find usbdev_video.reg !!!
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CAMERA_SMI_W72_A05_SETUP-94RR4_ZPE.exe