URL:

http://download.anydesk.com/AnyDesk.exe

Full analysis: https://app.any.run/tasks/47cbc2ce-f7a0-433d-8eea-8fc961672e79
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 22, 2021, 15:13:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

18AD8B122B8871EA6A73FF8CF4094138

SHA1:

5B371E072E12CD87A34DBBC0795E784B0E6BF2CA

SHA256:

00CFD0C7BBD2C834037E1AD4CB6C23402A66A733BCB87B5CC364210EF47E5CA0

SSDEEP:

3:N1KaKEl/c3kwJC:Ca5lV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AnyDesk.exe (PID: 1232)
      • AnyDesk.exe (PID: 3356)
      • AnyDesk.exe (PID: 2244)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 756)
      • chrome.exe (PID: 2524)

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 756)
      • AnyDesk.exe (PID: 3356)

    • Creates files in the user directory

      • AnyDesk.exe (PID: 1232)
      • AnyDesk.exe (PID: 3356)

    • Cleans NTFS data-stream (Zone Identifier)

      • AnyDesk.exe (PID: 1232)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2524)
      • AnyDesk.exe (PID: 3356)

    • Application launched itself

      • AnyDesk.exe (PID: 1232)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 756)

    • Reads settings of System Certificates

      • chrome.exe (PID: 756)
      • chrome.exe (PID: 2524)

    • Application launched itself

      • chrome.exe (PID: 2524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
16
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs anydesk.exe no specs anydesk.exe anydesk.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10558212912013545873 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
756"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=9100189878721840234 --mojo-platform-channel-handle=1548 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10641449142174424972 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1232"C:\Users\admin\Downloads\AnyDesk.exe" C:\Users\admin\Downloads\AnyDesk.exe—chrome.exe
User:
admin
Company:
philandro Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
6.2.3.0
Modules
Images
c:\users\admin\downloads\anydesk.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=6804113990185535368 --mojo-platform-channel-handle=3236 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2244"C:\Users\admin\Downloads\AnyDesk.exe" --local-controlC:\Users\admin\Downloads\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
philandro Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
0
Version:
6.2.3.0
Modules
Images
c:\users\admin\downloads\anydesk.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1940 --on-initialized-event-handle=316 --parent-handle=320 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2332"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=9795527578178291680 --mojo-platform-channel-handle=944 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2344"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11197252574728774707 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,3659150298866822062,12986881461174966239,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=261435478209365093 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
1 358
Read events
1 285
Write events
70
Delete events
3

Modification events

(PID) Process:(2304) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2524-13260899606778375
Value:
259
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2524) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(2524) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
7
Suspicious files
10
Text files
111
Unknown types
0

Dropped files

PID
Process
Filename
Type
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6058B417-9DC.pma —
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2820b764-2b81-4f85-a229-e56beb0c8f3d.tmp —
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF484cc.TMPtext
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF4849d.TMPtext
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2524chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF486c0.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
15
DNS requests
9
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3356
AnyDesk.exe
POST
204
176.34.140.171:80
http://api.playanext.com/httpapi
IE
—
—
whitelisted
756
chrome.exe
GET
200
159.69.19.197:80
http://download.anydesk.com/AnyDesk.exe
US
executable
3.57 Mb
whitelisted
756
chrome.exe
GET
200
159.69.19.197:80
http://download.anydesk.com/AnyDesk.exe
US
executable
3.57 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
756
chrome.exe
172.217.19.109:443
accounts.google.com
Google Inc.
US
unknown
756
chrome.exe
159.69.19.197:80
download.anydesk.com
—
US
suspicious
756
chrome.exe
142.250.186.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
756
chrome.exe
216.58.207.142:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3356
AnyDesk.exe
213.239.219.11:443
boot-01.net.anydesk.com
Hetzner Online GmbH
DE
suspicious
3356
AnyDesk.exe
116.202.229.59:80
relay-033a5347.net.anydesk.com
334,Udyog Vihar
IN
unknown
3356
AnyDesk.exe
176.34.140.171:80
api.playanext.com
Amazon.com, Inc.
IE
suspicious
3356
AnyDesk.exe
116.202.162.91:80
relay-de1a3471.net.anydesk.com
334,Udyog Vihar
IN
suspicious
756
chrome.exe
216.58.212.142:443
clients1.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
download.anydesk.com
  • 159.69.19.197
whitelisted
accounts.google.com
  • 172.217.19.109
shared
ssl.gstatic.com
  • 142.250.186.163
whitelisted
sb-ssl.google.com
  • 216.58.207.142
whitelisted
boot-01.net.anydesk.com
  • 213.239.219.11
whitelisted
relay-033a5347.net.anydesk.com
  • 116.202.229.59
unknown
relay-de1a3471.net.anydesk.com
  • 116.202.162.91
suspicious
api.playanext.com
  • 176.34.140.171
  • 63.35.165.43
  • 52.210.10.21
whitelisted
clients1.google.com
  • 216.58.212.142
whitelisted

Threats

PID
Process
Class
Message
756
chrome.exe
Misc activity
ET INFO Packed Executable Download
756
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
756
chrome.exe
Misc activity
ET INFO Packed Executable Download
756
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3356
AnyDesk.exe
Potential Corporate Privacy Violation
ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)
3356
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://download.anydesk.com/AnyDesk.exe