File name:

AnyDesk.exe

Full analysis: https://app.any.run/tasks/786774a6-8802-4674-8577-08a0e63c6200
Verdict: Malicious activity
Analysis date: June 30, 2024, 02:20:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AEE6801792D67607F228BE8CEC8291F9

SHA1:

BF6BA727FF14CA2FDDF619F292D56DB9D9088066

SHA256:

1CDAFBE519F60AAADB4A92E266FFF709129F86F0C9EE595C45499C66092E0499

SSDEEP:

98304:wbAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6da3Vo:KnxbeqNfE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1768)

    • Create files in the Startup directory

      • AnyDesk.exe (PID: 3976)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 4208)

  • SUSPICIOUS

    • Application launched itself

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5980)

    • Reads security settings of Internet Explorer

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)

    • Executable content was dropped or overwritten

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)
      • rundll32.exe (PID: 1852)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1768)

    • Reads the date of Windows installation

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)

    • Executes as Windows Service

      • AnyDesk.exe (PID: 1768)

    • Creates a software uninstall entry

      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)

    • Searches for installed software

      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 6912)
      • AnyDesk.exe (PID: 1924)

    • Unpacks CAB file

      • expand.exe (PID: 3968)

    • Creates files in the driver directory

      • drvinst.exe (PID: 4208)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 4208)

    • Potential Corporate Privacy Violation

      • AnyDesk.exe (PID: 1768)

    • Adds/modifies Windows certificates

      • rundll32.exe (PID: 1852)

  • INFO

    • Reads the computer name

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 1924)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 6912)

    • Creates files or folders in the user directory

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)

    • Checks supported languages

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • expand.exe (PID: 3968)
      • AnyDesk.exe (PID: 1924)
      • AnyDesk.exe (PID: 1004)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 6912)

    • Reads the machine GUID from the registry

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 1768)
      • expand.exe (PID: 3968)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1924)

    • Checks proxy server information

      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 5980)

    • Reads CPU info

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 1924)
      • AnyDesk.exe (PID: 6912)

    • Process checks computer location settings

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)

    • Creates files in the program directory

      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)

    • Manual execution by a user

      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 1924)

    • Reads the software policy settings

      • rundll32.exe (PID: 1852)
      • drvinst.exe (PID: 4208)
      • rundll32.exe (PID: 3940)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 1852)
      • rundll32.exe (PID: 3940)

    • Process checks whether UAC notifications are on

      • AnyDesk.exe (PID: 1004)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 1852)

    • Create files in a temporary directory

      • rundll32.exe (PID: 1852)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:24 12:53:23+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 5296640
UninitializedDataSize: 19093504
EntryPoint: 0x1ce5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.10.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 8.0.10
ProductName: AnyDesk
ProductVersion: 8
LegalCopyright: (C) 2022 AnyDesk Software GmbH
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
13
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe anydesk.exe anydesk.exe no specs expand.exe conhost.exe no specs rundll32.exe anydesk.exe no specs drvinst.exe rundll32.exe no specs anydesk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
476"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --local-controlC:\Users\admin\AppData\Local\Temp\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
1004"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" C:\Users\admin\AppData\Local\Temp\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
1768"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --serviceC:\Program Files (x86)\AnyDesk\AnyDesk.exe
services.exe
User:
SYSTEM
Company:
AnyDesk Software GmbH
Integrity Level:
SYSTEM
Description:
AnyDesk
Version:
8.0.10
Modules
Images
c:\program files (x86)\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
1852"C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"C:\Windows\SysWOW64\rundll32.exe
AnyDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1924"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-installC:\Program Files (x86)\AnyDesk\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.0.10
Modules
Images
c:\program files (x86)\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
3940rundll32.exe C:\WINDOWS\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2fd634f3-87ff-5e4d-bd80-95bd09871540} Global\{ba594c6a-282a-224f-9e43-821d8541bf50} C:\WINDOWS\System32\DriverStore\Temp\{44b3626b-b55e-dc4a-a66a-cb95f22401ba}\anydeskprintdriver.inf C:\WINDOWS\System32\DriverStore\Temp\{44b3626b-b55e-dc4a-a66a-cb95f22401ba}\AnyDeskPrintDriver.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3968expand -F:* "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver"C:\Windows\SysWOW64\expand.exe
AnyDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3972\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—expand.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3976"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\admin\AppData\Roaming\AnyDesk\system.conf" C:\Users\admin\AppData\Local\Temp\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
HIGH
Description:
AnyDesk
Exit code:
0
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
4208DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{cba176e1-100c-cb41-87e5-1c8bc46a3660}\anydeskprintdriver.inf" "9" "49a18f3d7" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
21 765
Read events
21 713
Write events
47
Delete events
5

Modification events

(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayIcon
Value:
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe"
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayName
Value:
AnyDesk
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayVersion
Value:
ad 8.0.10
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:EstimatedSize
Value:
2048
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:HelpLink
Value:
https://help.anydesk.com/
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:InstallLocation
Value:
"C:\Program Files (x86)\AnyDesk"
Executable files
12
Suspicious files
29
Text files
25
Unknown types
3

Dropped files

PID
Process
Filename
Type
5764AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\system.conftext
MD5:0C04AD1083DC5C7C45E3EE2CD344AE38
SHA256:6452273C017DB7CBE0FFC5B109BBF3F8D3282FB91BFA3C5EABC4FB8F1FC98CB0
1004AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W4OWI4275OVUIJBRUWVH.tempbinary
MD5:F2D20DDDA6D2DF2FD5E66E21A41323C3
SHA256:B877865FBDC8AD06A7BAF244287216973339C5550E7A421BC57B0172D1C4B9B9
3976AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnkbinary
MD5:36834416161FF7363D769E8726763EFE
SHA256:ECDC621951B373E6DFEE0404F19704C82D071F602D2AEF5952FE330FD18C0547
1004AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\ad.tracetext
MD5:FFE92AF61F031729D943635AFD9CFDF3
SHA256:43CD6B4E27BB29D9E45202F4BA79C29E7F9CA4A540263DAA9182CB983F032D82
3976AnyDesk.exeC:\Program Files (x86)\AnyDesk\AnyDesk.exeexecutable
MD5:AEE6801792D67607F228BE8CEC8291F9
SHA256:1CDAFBE519F60AAADB4A92E266FFF709129F86F0C9EE595C45499C66092E0499
5764AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\service.conftext
MD5:5A8370CAB843EF2BED5596D81457269F
SHA256:35DF1190598004CC2680603665BBCCDBEAC60E67E129B4AAADC9FC5418864661
3976AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk\Uninstall AnyDesk.lnklnk
MD5:03E71486918612395D71411AE8E99E0B
SHA256:0FCA4EA56E730904F86AE41522E0E8D20CE0F138054973249F5DD3076F40B72C
3976AnyDesk.exeC:\ProgramData\AnyDesk\service.conftext
MD5:EF41789B04AF2EFF078CB4CFACE43DA3
SHA256:A6875C980298F416469AC048417F5E4DC98ACC251B3D351238A1846E700F67B6
5764AnyDesk.exeC:\Users\admin\AppData\Local\Temp\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
3976AnyDesk.exeC:\ProgramData\AnyDesk\system.conftext
MD5:228CC9CF51C4D7C2093FD651CBACD100
SHA256:82625DACE844D1C7CF9688EAE6CC2F881D08FC4BA73A273828324A2B36DD4142
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
100
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2052
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3128
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
1768
AnyDesk.exe
POST
200
18.245.86.105:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3800
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2784
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5764
AnyDesk.exe
92.223.88.232:443
boot.net.anydesk.com
G-Core Labs S.A.
LU
unknown
5764
AnyDesk.exe
208.115.231.170:443
relay-bf39502a.net.anydesk.com
LIMESTONENETWORKS
US
unknown
4656
SearchApp.exe
92.123.104.32:443
—
Akamai International B.V.
DE
unknown
1544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
boot.net.anydesk.com
  • 92.223.88.232
unknown
relay-bf39502a.net.anydesk.com
  • 208.115.231.170
unknown
login.live.com
  • 20.190.159.2
  • 40.126.31.71
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.0
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
1768
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk.exe