File name:

AnyDesk.exe

Full analysis: https://app.any.run/tasks/786774a6-8802-4674-8577-08a0e63c6200
Verdict: Malicious activity
Analysis date: June 30, 2024, 02:20:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AEE6801792D67607F228BE8CEC8291F9

SHA1:

BF6BA727FF14CA2FDDF619F292D56DB9D9088066

SHA256:

1CDAFBE519F60AAADB4A92E266FFF709129F86F0C9EE595C45499C66092E0499

SSDEEP:

98304:wbAtLvz+qHVZ+eMR4YAPkW/PvNuaiXxKCGpIPahlhYjHiKloGshfz+D+yR6da3Vo:KnxbeqNfE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1768)

    • Create files in the Startup directory

      • AnyDesk.exe (PID: 3976)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 4208)

  • SUSPICIOUS

    • Application launched itself

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5980)

    • Executable content was dropped or overwritten

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)
      • rundll32.exe (PID: 1852)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1768)

    • Reads security settings of Internet Explorer

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)

    • Reads the date of Windows installation

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)

    • Creates a software uninstall entry

      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)

    • Executes as Windows Service

      • AnyDesk.exe (PID: 1768)

    • Searches for installed software

      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 1924)
      • AnyDesk.exe (PID: 6912)

    • Adds/modifies Windows certificates

      • rundll32.exe (PID: 1852)

    • Unpacks CAB file

      • expand.exe (PID: 3968)

    • Creates files in the driver directory

      • drvinst.exe (PID: 4208)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 4208)

    • Potential Corporate Privacy Violation

      • AnyDesk.exe (PID: 1768)

  • INFO

    • Creates files or folders in the user directory

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)
      • expand.exe (PID: 3968)

    • Reads the computer name

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 1924)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 6912)

    • Checks supported languages

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)
      • expand.exe (PID: 3968)
      • AnyDesk.exe (PID: 1924)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 6912)
      • AnyDesk.exe (PID: 1004)

    • Process checks whether UAC notifications are on

      • AnyDesk.exe (PID: 1004)

    • Reads the machine GUID from the registry

      • AnyDesk.exe (PID: 5764)
      • AnyDesk.exe (PID: 1768)
      • expand.exe (PID: 3968)
      • drvinst.exe (PID: 4208)
      • AnyDesk.exe (PID: 1924)

    • Checks proxy server information

      • AnyDesk.exe (PID: 476)
      • AnyDesk.exe (PID: 5980)

    • Process checks computer location settings

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)
      • AnyDesk.exe (PID: 5980)

    • Reads CPU info

      • AnyDesk.exe (PID: 1004)
      • AnyDesk.exe (PID: 1924)
      • AnyDesk.exe (PID: 6912)

    • Creates files in the program directory

      • AnyDesk.exe (PID: 3976)
      • AnyDesk.exe (PID: 1768)

    • Manual execution by a user

      • AnyDesk.exe (PID: 5980)
      • AnyDesk.exe (PID: 1924)

    • Reads the software policy settings

      • rundll32.exe (PID: 1852)
      • drvinst.exe (PID: 4208)
      • rundll32.exe (PID: 3940)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 1852)
      • rundll32.exe (PID: 3940)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 1852)

    • Create files in a temporary directory

      • rundll32.exe (PID: 1852)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:24 12:53:23+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 5296640
UninitializedDataSize: 19093504
EntryPoint: 0x1ce5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.10.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 8.0.10
ProductName: AnyDesk
ProductVersion: 8
LegalCopyright: (C) 2022 AnyDesk Software GmbH
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
13
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe anydesk.exe anydesk.exe no specs expand.exe conhost.exe no specs rundll32.exe anydesk.exe no specs drvinst.exe rundll32.exe no specs anydesk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
476"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --local-controlC:\Users\admin\AppData\Local\Temp\AnyDesk.exe—AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
1004"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" C:\Users\admin\AppData\Local\Temp\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
1768"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --serviceC:\Program Files (x86)\AnyDesk\AnyDesk.exe
services.exe
User:
SYSTEM
Company:
AnyDesk Software GmbH
Integrity Level:
SYSTEM
Description:
AnyDesk
Version:
8.0.10
Modules
Images
c:\program files (x86)\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
1852"C:\Windows\System32\rundll32.exe" printui.dll, PrintUIEntry /if /b "AnyDesk Printer" /f "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver\AnyDeskPrintDriver.inf" /r "AD_Port" /m "AnyDesk v4 Printer Driver"C:\Windows\SysWOW64\rundll32.exe
AnyDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1924"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --new-installC:\Program Files (x86)\AnyDesk\AnyDesk.exe—explorer.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Version:
8.0.10
Modules
Images
c:\program files (x86)\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\msvcrt.dll
3940rundll32.exe C:\WINDOWS\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2fd634f3-87ff-5e4d-bd80-95bd09871540} Global\{ba594c6a-282a-224f-9e43-821d8541bf50} C:\WINDOWS\System32\DriverStore\Temp\{44b3626b-b55e-dc4a-a66a-cb95f22401ba}\anydeskprintdriver.inf C:\WINDOWS\System32\DriverStore\Temp\{44b3626b-b55e-dc4a-a66a-cb95f22401ba}\AnyDeskPrintDriver.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3968expand -F:* "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver\v4.cab" "C:\Users\admin\AppData\Roaming\AnyDesk\printer_driver"C:\Windows\SysWOW64\expand.exe
AnyDesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3972\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—expand.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3976"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --install "C:\Program Files (x86)\AnyDesk" --start-with-win --create-shortcuts --create-taskbar-icon --create-desktop-icon --install-driver:mirror --install-driver:printer --update-main --svc-conf "C:\Users\admin\AppData\Roaming\AnyDesk\service.conf" --sys-conf "C:\Users\admin\AppData\Roaming\AnyDesk\system.conf" C:\Users\admin\AppData\Local\Temp\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
HIGH
Description:
AnyDesk
Exit code:
0
Version:
8.0.10
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
4208DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{cba176e1-100c-cb41-87e5-1c8bc46a3660}\anydeskprintdriver.inf" "9" "49a18f3d7" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\users\admin\appdata\roaming\anydesk\printer_driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
21 765
Read events
21 713
Write events
47
Delete events
5

Modification events

(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1004) AnyDesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayIcon
Value:
"C:\Program Files (x86)\AnyDesk\AnyDesk.exe"
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayName
Value:
AnyDesk
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayVersion
Value:
ad 8.0.10
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:EstimatedSize
Value:
2048
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:HelpLink
Value:
https://help.anydesk.com/
(PID) Process:(3976) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:InstallLocation
Value:
"C:\Program Files (x86)\AnyDesk"
Executable files
12
Suspicious files
29
Text files
25
Unknown types
3

Dropped files

PID
Process
Filename
Type
1004AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:F2D20DDDA6D2DF2FD5E66E21A41323C3
SHA256:B877865FBDC8AD06A7BAF244287216973339C5550E7A421BC57B0172D1C4B9B9
3976AnyDesk.exeC:\Users\Public\Desktop\AnyDesk.lnkbinary
MD5:14324E7D81E6625BD014321B7FA31453
SHA256:597372741E815DF6901858BDFCEA847D753327C73541A53F52F9746A7E0400D9
1004AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\user.conftext
MD5:A787C308BD30D6D844E711D7579BE552
SHA256:8A395011A6A877D3BDD53CC8688EF146160DAB9D42140EB4A70716AD4293A440
5764AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\service.conftext
MD5:5A8370CAB843EF2BED5596D81457269F
SHA256:35DF1190598004CC2680603665BBCCDBEAC60E67E129B4AAADC9FC5418864661
3976AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnkbinary
MD5:36834416161FF7363D769E8726763EFE
SHA256:ECDC621951B373E6DFEE0404F19704C82D071F602D2AEF5952FE330FD18C0547
3976AnyDesk.exeC:\ProgramData\AnyDesk\service.conftext
MD5:EF41789B04AF2EFF078CB4CFACE43DA3
SHA256:A6875C980298F416469AC048417F5E4DC98ACC251B3D351238A1846E700F67B6
3976AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk\AnyDesk.lnklnk
MD5:6CED33CE87F47FA5B9FD237E0D28F7B8
SHA256:58D214A7734CDE3B7C8B91DDAC87F7DB6046EFFF38A32AD240837C4C3C8BD108
3976AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk\Uninstall AnyDesk.lnklnk
MD5:03E71486918612395D71411AE8E99E0B
SHA256:0FCA4EA56E730904F86AE41522E0E8D20CE0F138054973249F5DD3076F40B72C
3976AnyDesk.exeC:\ProgramData\AnyDesk\system.conftext
MD5:228CC9CF51C4D7C2093FD651CBACD100
SHA256:82625DACE844D1C7CF9688EAE6CC2F881D08FC4BA73A273828324A2B36DD4142
3976AnyDesk.exeC:\Program Files (x86)\AnyDesk\AnyDesk.exeexecutable
MD5:AEE6801792D67607F228BE8CEC8291F9
SHA256:1CDAFBE519F60AAADB4A92E266FFF709129F86F0C9EE595C45499C66092E0499
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
100
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3128
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2052
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
1768
AnyDesk.exe
POST
200
18.245.86.105:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3800
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2784
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5764
AnyDesk.exe
92.223.88.232:443
boot.net.anydesk.com
G-Core Labs S.A.
LU
unknown
5764
AnyDesk.exe
208.115.231.170:443
relay-bf39502a.net.anydesk.com
LIMESTONENETWORKS
US
unknown
4656
SearchApp.exe
92.123.104.32:443
—
Akamai International B.V.
DE
unknown
1544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
boot.net.anydesk.com
  • 92.223.88.232
unknown
relay-bf39502a.net.anydesk.com
  • 208.115.231.170
unknown
login.live.com
  • 20.190.159.2
  • 40.126.31.71
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.0
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

PID
Process
Class
Message
1768
AnyDesk.exe
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk.exe