File name:

SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe

Full analysis: https://app.any.run/tasks/2898faef-430d-4bdb-ba56-1cef60d28f95
Verdict: Malicious activity
Analysis date: March 15, 2025, 03:06:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autorun-reg
malicious
untrustedcert
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

D5449B3813923EC29B3EE14D684673E6

SHA1:

2A47E656FB8F97C08195BAD992E3CAB95D16B4F3

SHA256:

63317C38473636E89EC07D91369299786DA92E8A6DBDFC172D169D34EBC04DEA

SSDEEP:

98304:nnVABzS803Lsz8weIaZ/VMCDQ1QqA/fbSKXylyq2rnJcUyvaVBdxh/FEjMVPV0Oa:nPc2U8kYnT9uEK/qyz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 5576)
      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • SRSSSC.exe (PID: 6564)
      • SRSSSC.exe (PID: 2236)

    • Changes the autorun value in the registry

      • SRSSSC.exe (PID: 2236)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)

    • Adds/modifies Windows certificates

      • msiexec.exe (PID: 4776)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5400)

    • There is functionality for taking screenshot (YARA)

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • SRSBFD7.tmp (PID: 5344)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6132)

    • Executable content was dropped or overwritten

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • drvinst.exe (PID: 2092)
      • drvinst.exe (PID: 6344)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 6132)
      • msiexec.exe (PID: 668)
      • drvinst.exe (PID: 2092)
      • drvinst.exe (PID: 6344)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 668)
      • SRSSSC.exe (PID: 2236)

    • Creates files in the driver directory

      • drvinst.exe (PID: 2092)
      • drvinst.exe (PID: 6344)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6344)

    • Reads Microsoft Outlook installation path

      • SRSSSC.exe (PID: 2236)

    • Reads Internet Explorer settings

      • SRSSSC.exe (PID: 2236)

  • INFO

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 4776)

    • Reads the computer name

      • SRSBFD7.tmp (PID: 5344)
      • msiexec.exe (PID: 6132)
      • msiexec.exe (PID: 5776)
      • msiexec.exe (PID: 668)
      • msiexec.exe (PID: 6036)
      • drvinst.exe (PID: 2092)
      • drvinst.exe (PID: 6344)
      • SRSSSC.exe (PID: 2236)

    • Checks supported languages

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • SRSBFD7.tmp (PID: 5344)
      • msiexec.exe (PID: 6132)
      • msiexec.exe (PID: 5776)
      • msiexec.exe (PID: 668)
      • drvinst.exe (PID: 2092)
      • msiexec.exe (PID: 6036)
      • SRSSSC.exe (PID: 6564)
      • SRSSSC.exe (PID: 2236)
      • drvinst.exe (PID: 6344)

    • The sample compiled with english language support

      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • msiexec.exe (PID: 4776)
      • msiexec.exe (PID: 6132)

    • Create files in a temporary directory

      • SRSBFD7.tmp (PID: 5344)
      • SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe (PID: 6964)
      • msiexec.exe (PID: 668)
      • SRSSSC.exe (PID: 2236)

    • Reads the software policy settings

      • msiexec.exe (PID: 4776)
      • msiexec.exe (PID: 6132)
      • msiexec.exe (PID: 668)
      • drvinst.exe (PID: 2092)
      • slui.exe (PID: 2416)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4776)
      • msiexec.exe (PID: 668)
      • msiexec.exe (PID: 6132)

    • Manages system restore points

      • SrTasks.exe (PID: 2140)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6132)
      • msiexec.exe (PID: 668)
      • drvinst.exe (PID: 2092)

    • Checks proxy server information

      • msiexec.exe (PID: 4776)
      • SRSSSC.exe (PID: 2236)
      • slui.exe (PID: 2416)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 4776)
      • SRSSSC.exe (PID: 2236)

    • Application launched itself

      • msiexec.exe (PID: 6132)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6132)

    • Manual execution by a user

      • SRSSSC.exe (PID: 2236)

    • Creates files in the program directory

      • SRSSSC.exe (PID: 2236)

    • Autorun file from Registry key

      • SRSSSC.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:01:07 18:46:02+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 36864
InitializedDataSize: 8224768
UninitializedDataSize: -
EntryPoint: 0x2233
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.10.2.0
ProductVersionNumber: 1.10.2.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SRS Labs, Inc.
FileDescription: SRS Audio Sandbox Installer
FileVersion: 1.10.2.0
InternalName: SRS_Audio_Sandbox.exe
LegalCopyright: Copyright (C) 2000 SRS Labs, Inc.
OriginalFileName: SRS_Audio_Sandbox.exe
ProductName: SRS Audio Sandbox
ProductVersion: 1.10.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
16
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start srs audio sandbox 1.10.2.0 setup[h33t][espns].exe srsbfd7.tmp no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe drvinst.exe drvinst.exe srsssc.exe no specs slui.exe srsssc.exe srs audio sandbox 1.10.2.0 setup[h33t][espns].exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668C:\Windows\System32\MsiExec.exe -Embedding CE842F5AAADD6EA3F183B714E0261893C:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2092DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{14717e2c-95ad-5344-9852-4e41c2b98d16}\ssc.inf" "9" "41f56603f" "00000000000001D4" "WinSta0\Default" "00000000000001E4" "208" "c:\program files\srs labs\audio sandbox\driversupport"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2140C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2236"C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
explorer.exe
User:
admin
Company:
SRS Labs, Inc.
Integrity Level:
HIGH
Description:
SRS Audio Sandbox control panel
Version:
2.3.6.0
Modules
Images
c:\program files\srs labs\audio sandbox\srsssc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2416C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4776MSIEXEC.EXE /i "C:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\SRS Audio Sandbox.msi" TRANSFORMS="C:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\1033.MST" SETUPEXEDIR="C:\Users\admin\AppData\Local\Temp" SETUPEXENAME="SRSBFD7.tmp"C:\Windows\SysWOW64\msiexec.exe
SRSBFD7.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5344C:\Users\admin\AppData\Local\Temp\SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\SRSBFD7.tmp—SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe
User:
admin
Company:
SRS Labs, Inc.
Integrity Level:
HIGH
Description:
Setup Launcher Unicode
Exit code:
0
Version:
1.10.0200
Modules
Images
c:\users\admin\appdata\local\temp\srsbfd7.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5400C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5576"C:\Users\admin\SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe" C:\Users\admin\SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe—explorer.exe
User:
admin
Company:
SRS Labs, Inc.
Integrity Level:
MEDIUM
Description:
SRS Audio Sandbox Installer
Exit code:
3221226540
Version:
1.10.2.0
Modules
Images
c:\users\admin\srs audio sandbox 1.10.2.0 setup[h33t][espns].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
24 806
Read events
23 874
Write events
901
Delete events
31

Modification events

(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:742C3192E607E424EB4549542BE1BBC53E6174E2
Value:
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
Operation:writeName:Blob
Value:
04000000010000001000000010FC635DF6263E0DF325BE5F79CD67677E0000000100000008000000000010C51E92D2011D000000010000001000000027B3517667331CE2C1E74002B5FF2298620000000100000020000000E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E7009000000010000002A000000302806082B0601050507030206082B0601050507030306082B0601050507030406082B0601050507030119000000010000001000000091161B894B117ECDC257628DB460CC04030000000100000014000000742C3192E607E424EB4549542BE1BBC53E6174E20F0000000100000010000000D7C63BE0837DBABF881D4FBF5F986AD80B000000010000004600000056006500720069005300690067006E00200043006C006100730073002000330020005000750062006C006900630020005000720069006D00610072007900200043004100000053000000010000002400000030223020060A2B0601040182375E010130123010060A2B0601040182373C0101030200C0140000000100000014000000E27F7BD877D5DF9E0A3F9EB4CB0E2EA9EFDB69777A000000010000000E000000300C060A2B0601040182375E010268000000010000000800000000003DB65BD9D5012000000001000000400200003082023C308201A5021070BAE41D10D92934B638CA7B03CCBABF300D06092A864886F70D0101020500305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F72697479301E170D3936303132393030303030305A170D3238303830313233353935395A305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F7269747930819F300D06092A864886F70D010101050003818D0030818902818100C95C599EF21B8A0114B410DF0440DBE357AF6A45408F840C0BD133D9D911CFEE02581F25F72AA84405AAEC031F787F9E93B99A00AA237DD6AC85A26345C77227CCF44CC67571D239EF4F42F075DF0A90C68E206F980FF8AC235F702936A4C986E7B19A20CB53A585E73DBE7D9AFE244533DC7615ED0FA271644C652E816845A70203010001300D06092A864886F70D010102050003818100BB4C122BCF2C26004F1413DDA6FBFC0A11848CF3281C67922F7CB6C5FADFF0E895BC1D8F6C2CA851CC73D8A4C053F04ED626C076015781925E21F1D1B1FFE7D02158CD6917E3441C9C194439895CDC9C000F568D0299EDA290454CE4BB10A43DF032030EF1CEF8E8C9518CE6629FE69FC07DB7729CC9363A6B9F4EA8FF640D64
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
Operation:writeName:Blob
Value:
5C00000001000000040000000004000068000000010000000800000000003DB65BD9D5017A000000010000000E000000300C060A2B0601040182375E0102140000000100000014000000E27F7BD877D5DF9E0A3F9EB4CB0E2EA9EFDB697753000000010000002400000030223020060A2B0601040182375E010130123010060A2B0601040182373C0101030200C00B000000010000004600000056006500720069005300690067006E00200043006C006100730073002000330020005000750062006C006900630020005000720069006D0061007200790020004300410000000F0000000100000010000000D7C63BE0837DBABF881D4FBF5F986AD8030000000100000014000000742C3192E607E424EB4549542BE1BBC53E6174E219000000010000001000000091161B894B117ECDC257628DB460CC0409000000010000002A000000302806082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070301620000000100000020000000E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E701D000000010000001000000027B3517667331CE2C1E74002B5FF22987E0000000100000008000000000010C51E92D20104000000010000001000000010FC635DF6263E0DF325BE5F79CD67672000000001000000400200003082023C308201A5021070BAE41D10D92934B638CA7B03CCBABF300D06092A864886F70D0101020500305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F72697479301E170D3936303132393030303030305A170D3238303830313233353935395A305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F7269747930819F300D06092A864886F70D010101050003818D0030818902818100C95C599EF21B8A0114B410DF0440DBE357AF6A45408F840C0BD133D9D911CFEE02581F25F72AA84405AAEC031F787F9E93B99A00AA237DD6AC85A26345C77227CCF44CC67571D239EF4F42F075DF0A90C68E206F980FF8AC235F702936A4C986E7B19A20CB53A585E73DBE7D9AFE244533DC7615ED0FA271644C652E816845A70203010001300D06092A864886F70D010102050003818100BB4C122BCF2C26004F1413DDA6FBFC0A11848CF3281C67922F7CB6C5FADFF0E895BC1D8F6C2CA851CC73D8A4C053F04ED626C076015781925E21F1D1B1FFE7D02158CD6917E3441C9C194439895CDC9C000F568D0299EDA290454CE4BB10A43DF032030EF1CEF8E8C9518CE6629FE69FC07DB7729CC9363A6B9F4EA8FF640D64
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:4F65566336DB6598581D584A596C87934D5F2AB4
Value:
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4
Operation:writeName:Blob
Value:
5C00000001000000040000000004000019000000010000001000000091161B894B117ECDC257628DB460CC040300000001000000140000004F65566336DB6598581D584A596C87934D5F2AB41D000000010000001000000027B3517667331CE2C1E74002B5FF2298140000000100000014000000E27F7BD877D5DF9E0A3F9EB4CB0E2EA9EFDB697709000000010000002A000000302806082B0601050507030406082B0601050507030206082B0601050507030306082B060105050703010B000000010000003800000056006500720069005300690067006E00200043006C006100730073002000330020005000720069006D006100720079002000430041000000040000000100000010000000782A02DFDB2E14D5A75F0ADFB68E9C5D0F0000000100000010000000F1BBAC2D9038DDEC8DB173C53BC72A2A2000000001000000410200003082023D308201A6021100E49EFDF33AE80ECFA5113E19A4240232300D06092A864886F70D0101020500305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F72697479301E170D3936303132393030303030305A170D3034303130373233353935395A305F310B300906035504061302555331173015060355040A130E566572695369676E2C20496E632E31373035060355040B132E436C6173732033205075626C6963205072696D6172792043657274696669636174696F6E20417574686F7269747930819F300D06092A864886F70D010101050003818D0030818902818100C95C599EF21B8A0114B410DF0440DBE357AF6A45408F840C0BD133D9D911CFEE02581F25F72AA84405AAEC031F787F9E93B99A00AA237DD6AC85A26345C77227CCF44CC67571D239EF4F42F075DF0A90C68E206F980FF8AC235F702936A4C986E7B19A20CB53A585E73DBE7D9AFE244533DC7615ED0FA271644C652E816845A70203010001300D06092A864886F70D0101020500038181006170EC2F3F9EFD2BE6685421B06779080C2096318A0D7ABEB626DF792C22694936E397776261A232D77A542136BA02C934E725DA4435B0D25C805DB394F8F9ACEEA460752A1F954923B14A7CF4B34772215B7E97AB54AC62E75DECAE9BD2C9B224FB82ADE967154BBAAAA6F097A0F6B0975700C80C3C09A08204BA41DAF799A4
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(4776) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(6132) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
480000000000000099EF9D545795DB01F417000020060000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
28
Suspicious files
57
Text files
9
Unknown types
1

Dropped files

PID
Process
Filename
Type
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\SRS Audio Sandbox.msi —
MD5:—
SHA256:—
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\Setup.INItext
MD5:7785F239AE0AB99FDB4EFB9E1852F6BD
SHA256:A108385DE6F07521BE5569F75FA04E35EE45971942F37FC3751AD8C1AAD99348
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\_isC093.tmpbinary
MD5:888A97199186F416E04E5E4A0CB32CC2
SHA256:73923373866302C52BB667599089C973E143A5B5EF5A7931ECDA5A288AEF7103
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\0x0404.initext
MD5:CBF701214E39516D60DF48852A4A3577
SHA256:38FD1AC7CF1D6E8785189663E366EE01D712A95BFC69FE9ADBA8AE5DC9B682D9
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\_isC0B4.tmpbinary
MD5:7FAD844BB39CAC256A39B6C4BD1023E6
SHA256:46AB629A346792DACC46D5500AB0176D03D91B692CCBA8516592FA428F43F383
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\_ISMSIDEL.INItext
MD5:AEAD7EF4B7A43799D79654A9FA67E724
SHA256:9EC847EC57B6898D962EF7237C15803C9534F75F0279B5DC24CD49B5185090CB
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\0x0804.initext
MD5:D79173462CB9377187D61EC9CAF58344
SHA256:E99A2F085D31FA583A54804F5784AC6CA3E1FBB505C8A26251532C7287EA2CD4
6132msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6132msiexec.exeC:\Windows\Installer\1154d4.msi —
MD5:—
SHA256:—
5344SRSBFD7.tmpC:\Users\admin\AppData\Local\Temp\{5188D685-7D79-4B50-A4D3-7ECE97551641}\0x0409.initext
MD5:758747727E96A23C7C5A5BBB011656E4
SHA256:BAD3B2E854149DF9413F06E6C1C7B7C875545393877F59B59907F6B083CE5825
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
41
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4776
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4776
msiexec.exe
GET
200
184.30.131.114:80
http://crl.verisign.com/pca3.crl
unknown
—
—
whitelisted
4776
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4776
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE%2FlB8ILcQ1m6ShHvICEFgbsdEJWuvmo5QHNZoWl8Q%3D
unknown
—
—
whitelisted
4776
msiexec.exe
GET
200
184.30.131.114:80
http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE%2FlB8ILcQ1m6ShHvICEFgbsdEJWuvmo5QHNZoWl8Q%3D
unknown
—
—
whitelisted
1312
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6644
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6644
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4776
msiexec.exe
184.30.131.114:80
ocsp.verisign.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.5
  • 23.216.77.23
  • 23.216.77.21
  • 23.216.77.10
whitelisted
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.131
  • 20.190.159.4
  • 20.190.159.2
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
ocsp.verisign.com
  • 184.30.131.114
  • 2.23.79.3
whitelisted
crl.verisign.com
  • 184.30.131.114
whitelisted
csc3-2009-2-crl.verisign.com
  • —
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SRS Audio Sandbox 1.10.2.0 Setup[h33t][eSpNs].exe