File name:

AJAZZ Driver (X)-V1.0.5.3.exe

Full analysis: https://app.any.run/tasks/b81ec80c-1005-4fbf-a511-1ae738ff76ba
Verdict: Malicious activity
Analysis date: June 02, 2025, 10:23:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

1F2F9242F4E8926CE4F6951291A01D45

SHA1:

0624FA8D0AC5ABFA33BCD450FBA4440DF8C8C769

SHA256:

C5610DA5DDFF71DF502871E6562DC9D3C93404C969DC70D0BFCEFD8030A42345

SSDEEP:

98304:c+QqZ8flWr0zqvAC5rjA8MKbOI3pBhkKgsedqvNqutz6UzzMvGeiPe0sfUQTfR9b:VgY4QK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AJAZZ Driver (X)-V1.0.5.3.exe (PID: 6992)
      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • AJAZZ Driver (X).exe (PID: 5508)
      • Mouse-Setup-1.0.6.0.exe (PID: 2600)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Reads the Windows owner or organization settings

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Reads security settings of Internet Explorer

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • AJAZZ Driver (X).exe (PID: 5508)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)
      • AJAZZ Driver (X).exe (PID: 6708)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 4212)

    • The process drops C-runtime libraries

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Process drops legitimate windows executable

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Starts CMD.EXE for commands execution

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Searches for installed software

      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

  • INFO

    • Create files in a temporary directory

      • AJAZZ Driver (X)-V1.0.5.3.exe (PID: 6992)
      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.exe (PID: 2600)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Reads the computer name

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)
      • AJAZZ Driver (X).exe (PID: 5508)
      • AJAZZ Driver (X).exe (PID: 6708)

    • Checks supported languages

      • AJAZZ Driver (X)-V1.0.5.3.exe (PID: 6992)
      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.exe (PID: 2600)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)
      • AJAZZ Driver (X).exe (PID: 5508)
      • AJAZZ Driver (X).exe (PID: 6708)

    • Process checks computer location settings

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • AJAZZ Driver (X).exe (PID: 5508)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Creates files in the program directory

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • The sample compiled with chinese language support

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • The sample compiled with english language support

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Compiled with Borland Delphi (YARA)

      • AJAZZ Driver (X)-V1.0.5.3.exe (PID: 6992)

    • Detects InnoSetup installer (YARA)

      • AJAZZ Driver (X)-V1.0.5.3.exe (PID: 6992)

    • Creates a software uninstall entry

      • AJAZZ Driver (X)-V1.0.5.3.tmp (PID: 4380)
      • Mouse-Setup-1.0.6.0.tmp (PID: 684)

    • Creates files or folders in the user directory

      • AJAZZ Driver (X).exe (PID: 5508)

    • Checks proxy server information

      • AJAZZ Driver (X).exe (PID: 5508)
      • AJAZZ Driver (X).exe (PID: 6708)

    • Reads the machine GUID from the registry

      • AJAZZ Driver (X).exe (PID: 5508)
      • AJAZZ Driver (X).exe (PID: 6708)

    • Reads the software policy settings

      • AJAZZ Driver (X).exe (PID: 5508)
      • AJAZZ Driver (X).exe (PID: 6708)
      • slui.exe (PID: 5776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:06:03 08:09:11+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 85504
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: a-jazz, Inc.
FileDescription: AJAZZ Driver (X) Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: AJAZZ Driver (X)
ProductVersion: 1.0.5.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
16
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start ajazz driver (x)-v1.0.5.3.exe sppextcomobj.exe no specs slui.exe ajazz driver (x)-v1.0.5.3.tmp cmd.exe no specs conhost.exe no specs taskkill.exe no specs ajazz driver (x).exe mouse-setup-1.0.6.0.exe mouse-setup-1.0.6.0.tmp cmd.exe no specs conhost.exe no specs taskkill.exe no specs ajazz driver (x).exe slui.exe no specs ajazz driver (x)-v1.0.5.3.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Users\admin\AppData\Local\Temp\AJAZZ Driver (X)-V1.0.5.3.exe" C:\Users\admin\AppData\Local\Temp\AJAZZ Driver (X)-V1.0.5.3.exe—explorer.exe
User:
admin
Company:
a-jazz, Inc.
Integrity Level:
MEDIUM
Description:
AJAZZ Driver (X) Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\appdata\local\temp\ajazz driver (x)-v1.0.5.3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
684"C:\Users\admin\AppData\Local\Temp\is-MEQK8.tmp\Mouse-Setup-1.0.6.0.tmp" /SL5="$30252,4824320,827904,C:\Users\admin\AppData\Local\AJAZZ Driver (X) Files\temp\Mouse-Setup-1.0.6.0.exe" C:\Users\admin\AppData\Local\Temp\is-MEQK8.tmp\Mouse-Setup-1.0.6.0.tmp
Mouse-Setup-1.0.6.0.exe
User:
admin
Company:
a-jazz, Inc.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-meqk8.tmp\mouse-setup-1.0.6.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1228"C:\Windows\System32\cmd.exe" /C taskkill.exe /im "AJAZZ Driver (X).exe"C:\Windows\SysWOW64\cmd.exe—AJAZZ Driver (X)-V1.0.5.3.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1676C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2600"C:\Users\admin\AppData\Local\AJAZZ Driver (X) Files\temp\Mouse-Setup-1.0.6.0.exe" C:\Users\admin\AppData\Local\AJAZZ Driver (X) Files\temp\Mouse-Setup-1.0.6.0.exe
AJAZZ Driver (X).exe
User:
admin
Company:
a-jazz, Inc.
Integrity Level:
HIGH
Description:
AJAZZ Driver (X) Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\ajazz driver (x) files\temp\mouse-setup-1.0.6.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4212"C:\Windows\System32\cmd.exe" /C taskkill.exe /im "AJAZZ Driver (X).exe"C:\Windows\SysWOW64\cmd.exe—Mouse-Setup-1.0.6.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4380"C:\Users\admin\AppData\Local\Temp\is-O88R7.tmp\AJAZZ Driver (X)-V1.0.5.3.tmp" /SL5="$80302,4824320,827904,C:\Users\admin\AppData\Local\Temp\AJAZZ Driver (X)-V1.0.5.3.exe" C:\Users\admin\AppData\Local\Temp\is-O88R7.tmp\AJAZZ Driver (X)-V1.0.5.3.tmp
AJAZZ Driver (X)-V1.0.5.3.exe
User:
admin
Company:
a-jazz, Inc.
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-o88r7.tmp\ajazz driver (x)-v1.0.5.3.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
4572C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4932taskkill.exe /im "AJAZZ Driver (X).exe"C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5008taskkill.exe /im "AJAZZ Driver (X).exe"C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
3 545
Read events
3 484
Write events
60
Delete events
1

Modification events

(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids
Operation:writeName:AJAZZDriver(X)File.myp
Value:
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\AJAZZ Driver (X).exe\SupportedTypes
Operation:writeName:.myp
Value:
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_CURRENT_USER\SOFTWARE\AJAZZ Driver (X)
Operation:writeName:LCID
Value:
1033
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.0
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(4380) AJAZZ Driver (X)-V1.0.5.3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7123F778-1CA1-4DE1-894E-893E7075E6DD}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
Executable files
32
Suspicious files
34
Text files
400
Unknown types
2

Dropped files

PID
Process
Filename
Type
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\is-IT4M7.tmpexecutable
MD5:9565E1B6D6257B8D2B95D97CD1FF2077
SHA256:AAA76F4B0EF0F09CA43B3E4990D087223FFCC8D66987EBF2A5ECA59A6B697D46
6992AJAZZ Driver (X)-V1.0.5.3.exeC:\Users\admin\AppData\Local\Temp\is-O88R7.tmp\AJAZZ Driver (X)-V1.0.5.3.tmpexecutable
MD5:BDBCC29DA3161E4163325E7A3F4883CE
SHA256:BBCCE39A47B47E459CD6623FDB772E855E1FBD0B997023A6F61634857A1FA733
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\unins000.exeexecutable
MD5:8D2907A70F20E7499BB4D291E09A2EAF
SHA256:B1FDBAC79CFAF8E00DE1865B3E2B804E7312278530FAE907ED2FF9A933E1D705
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\is-N49MF.tmpexecutable
MD5:9565E1B6D6257B8D2B95D97CD1FF2077
SHA256:AAA76F4B0EF0F09CA43B3E4990D087223FFCC8D66987EBF2A5ECA59A6B697D46
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\is-7T4QB.tmpexecutable
MD5:8D2907A70F20E7499BB4D291E09A2EAF
SHA256:B1FDBAC79CFAF8E00DE1865B3E2B804E7312278530FAE907ED2FF9A933E1D705
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Users\admin\AppData\Local\Temp\is-T0UGC.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\AJAZZ Driver (X).exeexecutable
MD5:9565E1B6D6257B8D2B95D97CD1FF2077
SHA256:AAA76F4B0EF0F09CA43B3E4990D087223FFCC8D66987EBF2A5ECA59A6B697D46
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\config.xmlxml
MD5:8411544BD2CAEE967B47DE900DF39E3E
SHA256:BFE43F294CA96E3E534A54DDA64482E8D8B2E2EE554A00370DB234871768EB98
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\is-LU0LB.tmpxml
MD5:8411544BD2CAEE967B47DE900DF39E3E
SHA256:BFE43F294CA96E3E534A54DDA64482E8D8B2E2EE554A00370DB234871768EB98
4380AJAZZ Driver (X)-V1.0.5.3.tmpC:\Program Files (x86)\AJAZZ\AJAZZ Driver (X)\msvcp140.dllexecutable
MD5:C092885EA11BD80D35CB55C7D488F1E2
SHA256:885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
23
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5508
AJAZZ Driver (X).exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
—
—
whitelisted
5508
AJAZZ Driver (X).exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDHHzV4e8MyPX4hPiag%3D%3D
unknown
—
—
whitelisted
5508
AJAZZ Driver (X).exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
3192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1180
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5796
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.22
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.2
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.129
  • 20.190.159.23
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
xichen-upgrade-1304108977.cos.ap-guangzhou.myqcloud.com
  • 159.75.57.69
  • 159.75.57.35
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
5508
AJAZZ Driver (X).exe
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
6708
AJAZZ Driver (X).exe
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AJAZZ Driver (X)-V1.0.5.3.exe