URL:

usbdisplay.cn

Full analysis: https://app.any.run/tasks/7cc3454d-7cef-474e-8428-2440374249d3
Verdict: Malicious activity
Analysis date: September 30, 2024, 13:48:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

0D905E5EAC84CF6D344EEE0A1196712C

SHA1:

A8845CA6EB496BBD3CCF49BFE368298884528E76

SHA256:

A5375D34A473DE51786729395DFE9A05A00046E559B2A38DA58E0C9AE32A9FD2

SSDEEP:

3:DIn:M

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • USBDisplay_2.3.0.9.exe (PID: 2980)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • USBDisplay_2.3.0.9.exe (PID: 2980)

    • Drops a system driver (possible attempt to evade defenses)

      • USBDisplay_2.3.0.9.exe (PID: 2980)
      • devcon.exe (PID: 3848)
      • drvinst.exe (PID: 5600)
      • drvinst.exe (PID: 2808)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • USBDisplay_2.3.0.9.exe (PID: 2980)

    • Executable content was dropped or overwritten

      • USBDisplay_2.3.0.9.exe (PID: 2980)
      • devcon.exe (PID: 7304)
      • drvinst.exe (PID: 3144)
      • devcon.exe (PID: 3848)
      • drvinst.exe (PID: 5600)
      • drvinst.exe (PID: 2808)
      • drvinst.exe (PID: 1456)

    • The process drops C-runtime libraries

      • USBDisplay_2.3.0.9.exe (PID: 2980)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 8172)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2252)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 4016)
      • wscript.exe (PID: 7152)
      • USBDisplay.exe (PID: 2012)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 7328)

    • Executing commands from a ".bat" file

      • explorer.exe (PID: 4016)
      • wscript.exe (PID: 7152)

    • The process executes VB scripts

      • cmd.exe (PID: 7216)

    • Executes as Windows Service

      • WUDFHost.exe (PID: 2212)

    • Identifying current user with WHOAMI command

      • USBDisplay.exe (PID: 2012)

  • INFO

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 6568)

    • Manual execution by a user

      • WinRAR.exe (PID: 8172)

    • Application launched itself

      • firefox.exe (PID: 7068)
      • firefox.exe (PID: 6568)

    • Checks operating system version

      • USBDisplay.exe (PID: 2012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
48
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe no specs notepad.exe no specs usbdisplay_2.3.0.9.exe no specs usbdisplay_2.3.0.9.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs explorer.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs devcon.exe no specs find.exe no specs devcon.exe no specs find.exe no specs devcon.exe drvinst.exe drvinst.exe wudfhost.exe no specs devcon.exe no specs find.exe no specs devcon.exe drvinst.exe drvinst.exe usbdisplay.exe whoami.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1220"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5152 -childID 4 -isForBrowser -prefsHandle 5444 -prefMapHandle 5440 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1144 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66b814fd-ffdf-4a04-9ef5-1b975f422cfe} 6568 "\\.\pipe\gecko-crash-server-pipe.6568" 2b44302af50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1344netsh advfirewall firewall add rule name="USBDisplayFire" dir=in program="C:\Program Files (x86)\USBDisplay\USBDisplay.exe" action=allowC:\Windows\SysWOW64\netsh.exe—USBDisplay_2.3.0.9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1456DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{7f48a388-ffc9-0d4d-a4e1-92a28333dd0e}\displayproxy.inf" "9" "4b3b8a7f3" "00000000000001D4" "WinSta0\Default" "00000000000000F0" "208" "c:\progra~2\usbdis~1\win10d~1"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2012"C:\Program Files (x86)\USBDisplay\USBDisplay.exe"C:\Program Files (x86)\USBDisplay\USBDisplay.exe
USBDisplay_2.3.0.9.exe
User:
admin
Company:
Bozee
Integrity Level:
HIGH
Description:
USBDisplay
Version:
2.3.0.9
Modules
Images
c:\program files (x86)\usbdisplay\usbdisplay.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2212"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9833f36a-6070-4b8b-9a05-25b46a2a316d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2c9a68c0-8452-4abc-8cdb-3d723c01b3ad -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-89f9d6ee-b24f-457b-b891-cf889da6cf5f -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c507f5c1-f701-44ed-9868-e7420c9301c9 -LifetimeId:2eb95967-62b3-4cf0-afa6-cba570802dee -DeviceGroupId:DisplayProxy10Group -HostArg:0C:\Windows\System32\WUDFHost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Driver Foundation - User-mode Driver Framework Host Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wudfhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\devobj.dll
2240cmd.exe /C ver >C:\Users\admin\AppData\Roaming\systeminfo.tempC:\Windows\SysWOW64\cmd.exe—USBDisplay.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2252"C:\WINDOWS\explorer.exe" "C:\Program Files (x86)\USBDisplay\Win10Driver\install.bat"C:\Windows\explorer.exe—USBDisplay_2.3.0.9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2324C:\PROGRA~2\USBDIS~1\WIN10D~1\x64\devcon.exe find "hid\vid_1b36&pid_0d11" C:\Program Files (x86)\USBDisplay\Win10Driver\x64\devcon.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.14393.0 (rs1_release.160715-1616)
Modules
Images
c:\program files (x86)\usbdisplay\win10driver\x64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
2376"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -childID 2 -isForBrowser -prefsHandle 4480 -prefMapHandle 4476 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1144 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62e19191-e62d-410f-9344-a4fcfc59bb41} 6568 "\\.\pipe\gecko-crash-server-pipe.6568" 2b4402a1690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2640"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5128 -childID 3 -isForBrowser -prefsHandle 5432 -prefMapHandle 4636 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1144 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2669f3b-f8c1-4787-9d55-743f9f6d058e} 6568 "\\.\pipe\gecko-crash-server-pipe.6568" 2b44302a850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
32 895
Read events
32 230
Write events
650
Delete events
15

Modification events

(PID) Process:(6568) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\1-1727428735904_USBDisplay_2.3.0.9.zip
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8172) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
Operation:writeName:txtfile
Value:
(PID) Process:(2980) USBDisplay_2.3.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\USBDisplay
Operation:writeName:DisplayName
Value:
USBDisplay 2.3.0.9
(PID) Process:(2980) USBDisplay_2.3.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\USBDisplay
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\USBDisplay\uninst.exe
Executable files
83
Suspicious files
209
Text files
68
Unknown types
12

Dropped files

PID
Process
Filename
Type
6568firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:7613C2F96F64AA60491E6C27411B0E7D
SHA256:50D4BBEA8BCFA50FEF640E23B9B05A90E5E68E2B08DF2E8965BE47E5937AC851
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:7613C2F96F64AA60491E6C27411B0E7D
SHA256:50D4BBEA8BCFA50FEF640E23B9B05A90E5E68E2B08DF2E8965BE47E5937AC851
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6568firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bindbf
MD5:3B156E12141F8CBCE9D60CDCE2077617
SHA256:E6287E44B44ABEA20E1B2E3F415D22B9E5E5FBBC155AD9DADBABA63951B2AF6F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
97
DNS requests
114
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6568
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
142.250.74.195:80
http://o.pki.goog/s/wr3/XjA
unknown
—
—
whitelisted
6568
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
195.138.255.24:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
195.138.255.24:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
142.250.74.195:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
142.250.74.195:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
195.138.255.24:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6568
firefox.exe
POST
200
195.138.255.24:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5388
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6568
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
6568
firefox.exe
34.117.188.166:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
6568
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
usbdisplay.cn
  • 120.26.86.122
unknown
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
spocs.getpocket.com
  • 34.117.188.166
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
USBDisplay.exe
Language Locale : QLocale::English
USBDisplay.exe
Native UI.
USBDisplay.exe
Suspend Register Finish.
USBDisplay.exe
Find The File : "C:/Users/admin/AppData/Local/USBDisplay/conj2.ini"
USBDisplay.exe
Name : "conj2"
USBDisplay.exe
[Log Level] Start Finish Set.
USBDisplay.exe
[Log Level] Start Set.
USBDisplay.exe
Name size is : 5
USBDisplay.exe
AuthenticAMD
USBDisplay.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
usbdisplay.cn