URL:

AJAZZ.key123.vip/ENGwin

Full analysis: https://app.any.run/tasks/92e5de8f-4501-4b28-a2db-b7c997c13975
Verdict: Malicious activity
Analysis date: September 18, 2025, 13:47:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
anti-evasion
Indicators:
MD5:

C8F59CD3838431A59B53522E2CFD5AB8

SHA1:

A824B8EB73C9BC550490BCB7D9CAA9CEB24F03A6

SHA256:

8A186A9BD4F0564E8957ECDA5ED5C5E7FE0DFFCE61967EE5716D751520986122

SSDEEP:

3:HvNWLT5Dn:PELT5Dn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 2148)
      • slui.exe (PID: 8144)
      • backgroundTaskHost.exe (PID: 2536)
      • backgroundTaskHost.exe (PID: 5288)
      • backgroundTaskHost.exe (PID: 1096)
      • RuntimeBroker.exe (PID: 8156)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • CefViewWing.exe (PID: 6384)
      • SplashScreen.exe (PID: 1592)
      • conhost.exe (PID: 6532)
      • CefViewWing.exe (PID: 2112)
      • CefViewWing.exe (PID: 432)
      • CefViewWing.exe (PID: 2836)
      • CefViewWing.exe (PID: 420)
      • SystemMonitor.exe (PID: 1156)
      • consent.exe (PID: 5416)
      • CefViewWing.exe (PID: 1512)
      • svchost.exe (PID: 984)
      • svchost.exe (PID: 6836)
      • CefViewWing.exe (PID: 2708)
      • WmiPrvSE.exe (PID: 7728)
      • CefViewWing.exe (PID: 5576)
      • CefViewWing.exe (PID: 2348)
      • conhost.exe (PID: 1652)
      • streamdockSwitchAudio.exe (PID: 1752)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 4312)

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)

    • Executable content was dropped or overwritten

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • SystemMonitor.exe (PID: 1156)

    • Reads the Windows owner or organization settings

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4312)

    • Process drops legitimate windows executable

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4312)
      • Stream Dock AJAZZ.exe (PID: 2032)

    • Detects AdvancedInstaller (YARA)

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4168)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5432)

    • There is functionality for taking screenshot (YARA)

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4312)
      • Stream Dock AJAZZ.exe (PID: 2032)

    • Reads security settings of Internet Explorer

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • Stream Dock AJAZZ.exe (PID: 2032)

    • Executing commands from a ".bat" file

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • cmd.exe (PID: 3480)

    • Application launched itself

      • cmd.exe (PID: 3480)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3480)

    • Reads the date of Windows installation

      • Stream Dock AJAZZ.exe (PID: 2032)

    • Drops a system driver (possible attempt to evade defenses)

      • SystemMonitor.exe (PID: 1156)

    • Reads the BIOS version

      • SystemMonitor.exe (PID: 1156)

    • The process checks if it is being run in the virtual environment

      • SystemMonitor.exe (PID: 1156)

  • INFO

    • Reads security settings of Internet Explorer

      • backgroundTaskHost.exe (PID: 7544)
      • backgroundTaskHost.exe (PID: 5288)
      • RuntimeBroker.exe (PID: 8156)
      • backgroundTaskHost.exe (PID: 1096)

    • Application launched itself

      • msedge.exe (PID: 4832)

    • Checks supported languages

      • identity_helper.exe (PID: 8032)
      • RUXIMICS.exe (PID: 7084)
      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4312)
      • msiexec.exe (PID: 5768)
      • msiexec.exe (PID: 4724)
      • msiexec.exe (PID: 7744)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • SplashScreen.exe (PID: 1592)
      • CefViewWing.exe (PID: 6384)
      • CefViewWing.exe (PID: 2836)
      • CefViewWing.exe (PID: 420)
      • CefViewWing.exe (PID: 2112)
      • CefViewWing.exe (PID: 432)
      • CefViewWing.exe (PID: 1512)
      • SystemMonitor.exe (PID: 1156)
      • streamdockSwitchAudio.exe (PID: 1752)
      • CefViewWing.exe (PID: 2708)
      • CefViewWing.exe (PID: 5576)
      • CefViewWing.exe (PID: 2348)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 8008)
      • consent.exe (PID: 8176)
      • SIHClient.exe (PID: 8144)
      • slui.exe (PID: 6320)
      • slui.exe (PID: 8144)
      • backgroundTaskHost.exe (PID: 1096)
      • consent.exe (PID: 5416)

    • Reads the computer name

      • identity_helper.exe (PID: 8032)
      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4312)
      • msiexec.exe (PID: 5768)
      • msiexec.exe (PID: 4724)
      • msiexec.exe (PID: 7744)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • SplashScreen.exe (PID: 1592)
      • CefViewWing.exe (PID: 6384)
      • CefViewWing.exe (PID: 420)
      • SystemMonitor.exe (PID: 1156)

    • Reads Environment values

      • identity_helper.exe (PID: 8032)
      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4724)
      • msiexec.exe (PID: 7744)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 4832)
      • msiexec.exe (PID: 4168)
      • msiexec.exe (PID: 4312)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 3836)
      • RUXIMICS.exe (PID: 7084)
      • MusNotifyIcon.exe (PID: 4044)
      • svchost.exe (PID: 7704)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 3836)
      • MusNotifyIcon.exe (PID: 4044)
      • WmiPrvSE.exe (PID: 4580)

    • Creates files or folders in the user directory

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • backgroundTaskHost.exe (PID: 1096)
      • CefViewWing.exe (PID: 420)

    • The sample compiled with english language support

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • msiexec.exe (PID: 4168)
      • msiexec.exe (PID: 4312)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • SystemMonitor.exe (PID: 1156)

    • Create files in a temporary directory

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • svchost.exe (PID: 4544)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • SystemMonitor.exe (PID: 1156)

    • Loads dropped or rewritten executable

      • msedge.exe (PID: 2588)
      • msedge.exe (PID: 7728)
      • msedge.exe (PID: 7996)
      • msedge.exe (PID: 5644)
      • msedge.exe (PID: 2124)
      • msedge.exe (PID: 1976)
      • msedge.exe (PID: 3968)
      • msedge.exe (PID: 7096)
      • msedge.exe (PID: 2708)
      • msedge.exe (PID: 6936)

    • Checks proxy server information

      • slui.exe (PID: 8144)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • backgroundTaskHost.exe (PID: 1096)

    • Manages system restore points

      • SrTasks.exe (PID: 3688)

    • Manual execution by a user

      • Stream Dock AJAZZ.exe (PID: 2032)

    • Launching a file from a Registry key

      • msiexec.exe (PID: 4312)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4312)

    • Process checks computer location settings

      • Stream-Dock-AJAZZ-Installer_Windows_global.exe (PID: 4708)
      • CefViewWing.exe (PID: 2112)
      • Stream Dock AJAZZ.exe (PID: 2032)
      • CefViewWing.exe (PID: 432)
      • CefViewWing.exe (PID: 1512)
      • CefViewWing.exe (PID: 2708)
      • CefViewWing.exe (PID: 5576)
      • CefViewWing.exe (PID: 2348)

    • Reads the machine GUID from the registry

      • Stream Dock AJAZZ.exe (PID: 2032)

    • Reads CPU info

      • SystemMonitor.exe (PID: 1156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
216
Monitored processes
90
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs stream-dock-ajazz-installer_windows_global.exe no specs stream-dock-ajazz-installer_windows_global.exe msiexec.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs slui.exe vssvc.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msedge.exe no specs musnotifyicon.exe no specs svchost.exe no specs wmiprvse.exe no specs svchost.exe no specs backgroundtaskhost.exe no specs svchost.exe no specs runtimebroker.exe no specs svchost.exe no specs waasmedicagent.exe no specs sihclient.exe consent.exe no specs conhost.exe no specs musnotificationux.exe no specs ruximics.exe no specs svchost.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe runtimebroker.exe no specs stream dock ajazz.exe cmd.exe no specs conhost.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cefviewwing.exe splashscreen.exe no specs msedge.exe no specs cefviewwing.exe cefviewwing.exe cefviewwing.exe cefviewwing.exe msedge.exe no specs svchost.exe no specs svchost.exe no specs cefviewwing.exe consent.exe no specs systemmonitor.exe streamdockswitchaudio.exe no specs conhost.exe no specs wmiprvse.exe no specs cefviewwing.exe cefviewwing.exe cefviewwing.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420"C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QCefView/1.1.0 Chrome/109.0.5414.120 Safari/537.36" --lang=en-US --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --allow-running-insecure-content --remote-allow-origins=* --allow-file-access-from-files --allow-hidden-media-playback --allow-insecure-localhost --allow-http-screen-capture --disable-gpu --allow-outdated-plugins --disable-speech-api --disable-web-security --enable-media-stream --use-mock-keychain --no-sandbox --autoplay-policy=no-user-gesture-required --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2032 --bridge-obj-name=CallBridge --builtin-scheme-name=CallBridge --log-file="C:\Program Files (x86)\Stream Dock AJAZZ Global\debug.log" --mojo-platform-channel-handle=2564 --field-trial-handle=1528,i,13845024918953803955,13819517970438020371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing.exe
Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\stream dock ajazz global\cefview\cefviewwing.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files (x86)\stream dock ajazz global\cefview\libcef.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
432"C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QCefView/1.1.0 Chrome/109.0.5414.120 Safari/537.36" --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --allow-running-insecure-content --remote-allow-origins=* --allow-file-access-from-files --allow-hidden-media-playback --allow-insecure-localhost --allow-http-screen-capture --disable-gpu --allow-outdated-plugins --disable-speech-api --disable-web-security --enable-media-stream --use-mock-keychain --no-sandbox --autoplay-policy=no-user-gesture-required --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2032 --bridge-obj-name=CallBridge --builtin-scheme-name=CallBridge --first-renderer-process --no-sandbox --autoplay-policy=no-user-gesture-required --disable-speech-api --log-file="C:\Program Files (x86)\Stream Dock AJAZZ Global\debug.log" --remote-debugging-port=23519 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1528,i,13845024918953803955,13819517970438020371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing.exe
Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\stream dock ajazz global\cefview\cefviewwing.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files (x86)\stream dock ajazz global\cefview\msvcp140.dll
c:\program files (x86)\stream dock ajazz global\cefview\libcef.dll
c:\program files (x86)\stream dock ajazz global\cefview\vcruntime140.dll
c:\windows\system32\user32.dll
640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2352,i,11295292447917496201,14214577576987859948,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
984C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1096"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mcaC:\Windows\System32\backgroundTaskHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1156"C:\Users\admin\AppData\Roaming\HotSpot\StreamDock\plugins\com.hotspot.streamdock.system.monitor.sdPlugin\SystemMonitor.exe" -port 18618 -pluginUUID WJ9H3045SP222304JS4Q35910ENIE4C5 -registerEvent registerPlugin -info {"application":{"font":"HarmonyOS Sans","language":"en","platform":"windows","platformVersion":"10.0.19045","version":"2.9.121"},"colors":{"buttonMouseOverBackgroundColor":"#464646FF","buttonPressedBackgroundColor":"#303030FF","buttonPressedBorderColor":"#646464FF","buttonPressedTextColor":"#969696FF","highlightColor":"#0078FFFF"},"devicePixelRatio":1,"devices":[{"id":"58dbee7a577d76c19a4d16da2f85672e","name":"AKP153E","size":{"columns":6,"rows":3},"type":0}],"plugin":{"uuid":"com.hotspot.streamdock.system.monitor","version":"1.3.1"}}C:\Users\admin\AppData\Roaming\HotSpot\StreamDock\plugins\com.hotspot.streamdock.system.monitor.sdPlugin\SystemMonitor.exe
Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\hotspot\streamdock\plugins\com.hotspot.streamdock.system.monitor.sdplugin\systemmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1512"C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QCefView/1.1.0 Chrome/109.0.5414.120 Safari/537.36" --user-data-dir="C:\Users\admin\AppData\Local\CEF\User Data" --allow-running-insecure-content --remote-allow-origins=* --allow-file-access-from-files --allow-hidden-media-playback --allow-insecure-localhost --allow-http-screen-capture --disable-gpu --allow-outdated-plugins --disable-speech-api --disable-web-security --enable-media-stream --use-mock-keychain --no-sandbox --autoplay-policy=no-user-gesture-required --windows-job-name=CefView-Job-{f0a3c1e3-ff89-4581-8a45-f0bfd74c4bb0}-2032 --bridge-obj-name=CallBridge --builtin-scheme-name=CallBridge --no-sandbox --autoplay-policy=no-user-gesture-required --disable-speech-api --log-file="C:\Program Files (x86)\Stream Dock AJAZZ Global\debug.log" --remote-debugging-port=23519 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3724 --field-trial-handle=1528,i,13845024918953803955,13819517970438020371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files (x86)\Stream Dock AJAZZ Global\CefView\CefViewWing.exe
Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\stream dock ajazz global\cefview\cefviewwing.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files (x86)\stream dock ajazz global\cefview\libcef.dll
c:\program files (x86)\stream dock ajazz global\cefview\msvcp140.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1592"C:\Program Files (x86)\Stream Dock AJAZZ Global\SplashScreen.exe" ./CoreConfiguration/splash.gif 0 "Stream Dock AJAZZ" "Version: 3.10.191.0421" Loading ""C:\Program Files (x86)\Stream Dock AJAZZ Global\SplashScreen.exe—Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
62097
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\stream dock ajazz global\splashscreen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
c:\program files (x86)\stream dock ajazz global\qt5widgets.dll
1652\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—streamdockSwitchAudio.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1752C:\Users\admin\AppData\Roaming\HotSpot\StreamDock\plugins\com.mirabox.streamdock.switchAudio.sdPlugin\streamdockSwitchAudio.exe -port 18618 -pluginUUID L0D34498MN6U1E9TLKXA16T3K8AHP3GZ -registerEvent registerPlugin -info "{\"application\":{\"font\":\"HarmonyOS Sans\",\"language\":\"en\",\"platform\":\"windows\",\"platformVersion\":\"10.0.19045\",\"version\":\"2.10.179.426\"},\"colors\":{\"buttonMouseOverBackgroundColor\":\"#464646FF\",\"buttonPressedBackgroundColor\":\"#303030FF\",\"buttonPressedBorderColor\":\"#646464FF\",\"buttonPressedTextColor\":\"#969696FF\",\"highlightColor\":\"#0078FFFF\"},\"devicePixelRatio\":1,\"devices\":[{\"id\":\"58dbee7a577d76c19a4d16da2f85672e\",\"name\":\"AKP153E\",\"size\":{\"columns\":6,\"rows\":3},\"type\":0}],\"plugin\":{\"uuid\":\"com.mirabox.streamdock.switchAudio\",\"version\":\"1.0.2\"}}"C:\Users\admin\AppData\Roaming\HotSpot\StreamDock\plugins\com.mirabox.streamdock.switchAudio.sdPlugin\streamdockSwitchAudio.exe—Stream Dock AJAZZ.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\hotspot\streamdock\plugins\com.mirabox.streamdock.switchaudio.sdplugin\streamdockswitchaudio.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
Total events
48 017
Read events
46 987
Write events
995
Delete events
35

Modification events

(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4832) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
1A6390DFA99D2F00
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459482
Operation:writeName:WindowTabManagerFileMappingId
Value:
{2CB4494E-192B-4D86-A021-005791E81729}
(PID) Process:(4832) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
042DA8DFA99D2F00
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
Operation:writeName:Enabled
Value:
0
(PID) Process:(7544) backgroundTaskHost.exeKey:\REGISTRY\A\{0cf6e3b1-cc47-b775-87c1-74afb33e0c28}\LocalState
Operation:writeName:CleanupThrottlingData
Value:
5F0DCC6800000000EB04EFBBA228DC01
(PID) Process:(4832) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459482
Operation:writeName:WindowTabManagerFileMappingId
Value:
{ED44CD7A-49C0-47B9-A1B4-1701831A1DE0}
Executable files
412
Suspicious files
1 476
Text files
1 919
Unknown types
0

Dropped files

PID
Process
Filename
Type
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF18d646.TMP —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF18d646.TMP —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF18d656.TMP —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF18d656.TMP —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF18d656.TMP —
MD5:—
SHA256:—
4832msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
83
DNS requests
82
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6392
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:HqlCNVq02o_QFk01WLZTVIeq4-OkOkvhd61-143aZ6E&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6756
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2992
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6392
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6392
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6392
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6392
msedge.exe
2.23.227.211:443
copilot.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6392
msedge.exe
47.85.110.93:443
ajazz.key123.vip
—
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
ajazz.key123.vip
  • 47.85.110.93
unknown
copilot.microsoft.com
  • 2.23.227.211
  • 2.23.227.199
whitelisted
cdn1.key123.vip
  • 163.181.58.176
  • 163.181.58.177
  • 163.181.58.174
  • 163.181.58.173
  • 163.181.58.175
  • 163.181.58.172
  • 163.181.58.170
  • 163.181.58.171
malicious
update.googleapis.com
  • 142.250.186.35
  • 142.250.186.131
whitelisted
www.bing.com
  • 2.23.227.202
  • 2.23.227.215
  • 2.23.227.208
  • 2.16.241.216
  • 2.16.241.222
  • 2.16.241.218
  • 2.16.241.224
  • 2.16.241.212
  • 2.16.241.196
  • 2.16.241.225
  • 2.16.241.200
  • 2.16.241.219
whitelisted
clients2.googleusercontent.com
  • 216.58.206.33
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
A Network Trojan was detected
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
Process
Message
CefViewWing.exe
[INFO]CefViewWing is launching....
CefViewWing.exe
[INFO]process type parameter is: g
CefViewWing.exe
[INFO]built-in scheme name: C
CefViewWing.exe
[INFO]bridge object name: C
CefViewWing.exe
[INFO]CefViewWing is launching....
CefViewWing.exe
[INFO]process type parameter is: u
CefViewWing.exe
[INFO]built-in scheme name: C
CefViewWing.exe
[INFO]bridge object name: C
CefViewWing.exe
[INFO]CefViewWing is launching....
CefViewWing.exe
[INFO]process type parameter is: u
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AJAZZ.key123.vip/ENGwin