| File name: | anydesk_7.0.0-1_amd64.deb |
| Full analysis: | https://app.any.run/tasks/56d4a494-75c3-493a-ac6d-907730c326cb |
| Verdict: | Malicious activity |
| Analysis date: | July 05, 2025, 22:33:21 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/vnd.debian.binary-package |
| File info: | Debian binary package (format 2.0), with control.tar.gz , data compression gz |
| MD5: | 962AEC45440B2293F237B9D4409D2691 |
| SHA1: | EF5E5CE9565472423743B42B1E34E47D2E7302C9 |
| SHA256: | 888E991906E37D521DEBC9E929ACA0FC76C2E5AD2AAF587D6200191587B0A6A2 |
| SSDEEP: | 98304:M3TaIkBi9X6f4TCekNwD6U11Ja8Ap2VS76m7/8RcH6+mQ11qF4yMXXceUPUf2Iz0:gQJENPulNmerdHO+4JBAyFfUu |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads the Internet Settings
- sipnotify.exe (PID: 1608)
- GettingStarted.exe (PID: 2616)
- migwiz.exe (PID: 2628)
The process executes via Task Scheduler
- sipnotify.exe (PID: 1608)
Reads Internet Explorer settings
- migwiz.exe (PID: 2628)
Creates file in the systems drive root
- migwiz.exe (PID: 2628)
Reads Microsoft Outlook installation path
- migwiz.exe (PID: 2628)
Searches for installed software
- migwiz.exe (PID: 2628)
INFO
Reads the computer name
- IMEKLMG.EXE (PID: 1744)
- IMEKLMG.EXE (PID: 1804)
Manual execution by a user
- IMEKLMG.EXE (PID: 1744)
- IMEKLMG.EXE (PID: 1804)
- GettingStarted.exe (PID: 2616)
- chrome.exe (PID: 3564)
Reads Microsoft Office registry keys
- migwiz.exe (PID: 2628)
Reads mouse settings
- migwiz.exe (PID: 2628)
Checks supported languages
- IMEKLMG.EXE (PID: 1744)
- IMEKLMG.EXE (PID: 1804)
Process checks whether UAC notifications are on
- IMEKLMG.EXE (PID: 1744)
- IMEKLMG.EXE (PID: 1804)
Application launched itself
- chrome.exe (PID: 3564)
- chrmstp.exe (PID: 1704)
- chrmstp.exe (PID: 588)
Checks proxy server information
- migwiz.exe (PID: 2628)
Creates files in the program directory
- chrome.exe (PID: 3564)
- chrmstp.exe (PID: 1704)
- chrmstp.exe (PID: 588)
Executable content was dropped or overwritten
- chrome.exe (PID: 636)
The sample compiled with english language support
- chrome.exe (PID: 636)
Reads security settings of Internet Explorer
- GettingStarted.exe (PID: 2616)
- migwiz.exe (PID: 2628)
Checks transactions between databases Windows and Oracle
- mighost.exe (PID: 2716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .deb | | | Debian Linux Package (65.7) |
|---|---|---|
| .ar | | | ar archive (19.1) |
| .kap | | | MapInfo Sea Chart (15) |
EXIF
EXE
| CreateDate: | 2025:04:16 13:50:41+00:00 |
|---|
Total processes
129
Monitored processes
42
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 588 | "C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings | C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: HIGH Description: Google Chrome Installer Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 636 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=664 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: Administrator Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 756 | "C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x678ba8,0x678bb8,0x678bc4 | C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe | — | chrmstp.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: HIGH Description: Google Chrome Installer Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 764 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1092 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3176 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1200 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4184 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1268 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\anydesk_7.0.0-1_amd64.deb | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1336 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1508 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1608 | C:\Windows\system32\sipnotify.exe -LogonOrUnlock | C:\Windows\System32\sipnotify.exe | taskeng.exe | ||||||||||||
User: Administrator Company: Microsoft Corporation Integrity Level: HIGH Description: sipnotify Exit code: 0 Version: 6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716) Modules
| |||||||||||||||
| 1700 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1188,i,6863889942930408581,5284443395639410505,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: Administrator Company: Google LLC Integrity Level: HIGH Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
Total events
423 634
Read events
422 635
Write events
924
Delete events
75
Modification events
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | ProxyBypass |
Value: | |||
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | ProxyBypass |
Value: | |||
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | IntranetName |
Value: | |||
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | IntranetName |
Value: | |||
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2616) GettingStarted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2628) migwiz.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\GDIPlus |
| Operation: | write | Name: | FontCachePath |
Value: C:\Users\Administrator\AppData\Local | |||
| (PID) Process: | (2628) migwiz.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | ProxyBypass |
Value: | |||
| (PID) Process: | (2628) migwiz.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | ProxyBypass |
Value: | |||
| (PID) Process: | (2628) migwiz.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | delete value | Name: | IntranetName |
Value: | |||
Executable files
5
Suspicious files
389
Text files
176
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1608 | sipnotify.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\SipNotify\default.cab | compressed | |
MD5:340674F6A3D1562E28A011EC11E40D83 | SHA256:259880E2346D986ABEED46AA9C2917C53E969AAE6927F2CA0A2AD0967736DF98 | |||
| 1744 | IMEKLMG.EXE | C:\Users\Administrator\AppData\Local\Temp\IME2010imeklmg00000002.log | text | |
MD5:85CB0A7C85F412D906A259BF9492EE74 | SHA256:432203B41A8E419BCD746E5922A2EB43C3502C6799302F117D59DC58D1E662FC | |||
| 2628 | migwiz.exe | C:\Users\Administrator\AppData\Local\Temp\tmp8BE5.tmp\Temp\PrivateData\00000000.PDT | image | |
MD5:343FA15C150A516B20CC9F787CFD530E | SHA256:D632E9DBACDCD8F6B86BA011ED6B23F961D104869654CAA764216EA57A916524 | |||
| 1608 | sipnotify.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\styles.css | text | |
MD5:3383EEF350240253D7C2C2564381B3CB | SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8 | |||
| 2716 | mighost.exe | C:\Users\Administrator\AppData\Local\MigWiz\diagerr.xml | text | |
MD5:0D1429C81C1BC270B50B79E6CD68B3D7 | SHA256:E4E454E66ABAB07343BF89CBD245508DD4538663C43E3D4425104F88DE77DA6F | |||
| 2628 | migwiz.exe | C:\Users\Administrator\AppData\Local\Temp\tmp86A4.tmp\tmpC347.tmp | binary | |
MD5:5BF851A9202BAD27BCEA7206DD15B01F | SHA256:407EB0244CE930EAAFEE6A36DE3C295F6CF9F605901673A61CB2C93B2167E2E4 | |||
| 1608 | sipnotify.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\script.js | text | |
MD5:A2682382967C351F7ED21762F9E5DE9E | SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2 | |||
| 1608 | sipnotify.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\metadata.json | binary | |
MD5:253EDC8EC7674BD78293FF3B21866074 | SHA256:51C3A033F0160A30C1773F1E5A9CD01AB018B151EDA1BB64D0226B2437106A56 | |||
| 2628 | migwiz.exe | C:\Users\Administrator\AppData\Local\MigWiz\Temp.MigWiz\USRC316.tmp | image | |
MD5:343FA15C150A516B20CC9F787CFD530E | SHA256:D632E9DBACDCD8F6B86BA011ED6B23F961D104869654CAA764216EA57A916524 | |||
| 2628 | migwiz.exe | C:\Users\Administrator\AppData\Local\Temp\tmp8BF8.tmp\tmpC346.tmp | binary | |
MD5:5BF851A9202BAD27BCEA7206DD15B01F | SHA256:407EB0244CE930EAAFEE6A36DE3C295F6CF9F605901673A61CB2C93B2167E2E4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
45
DNS requests
38
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 503 | 104.102.43.250:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133962320363060000 | unknown | — | — | whitelisted |
1608 | sipnotify.exe | HEAD | 503 | 23.67.143.243:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133962321007810000 | unknown | — | — | whitelisted |
888 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
3736 | chrome.exe | GET | 302 | 172.217.18.14:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
888 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acvebl5hyowh6yyy3wmoaw5wbfpa_4.10.2830.100/oimompecagnajdejgnnjijobebaeigek_4.10.2830.100_win32_acmfn7n2mz6vs4wnlypsmq4uakaq.crx3 | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
— | — | 104.102.43.250:80 | query.prod.cms.rt.microsoft.com | AKAMAI-AS | DE | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
1608 | sipnotify.exe | 23.67.143.243:80 | query.prod.cms.rt.microsoft.com | AKAMAI-AS | DE | whitelisted |
3564 | chrome.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3736 | chrome.exe | 142.250.181.227:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
3736 | chrome.exe | 173.194.3.42:443 | r5---sn-25ge7nzr.gvt1.com | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
query.prod.cms.rt.microsoft.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
clients2.google.com |
| whitelisted |
redirector.gvt1.com |
| whitelisted |
accounts.google.com |
| whitelisted |
r5---sn-25ge7nzr.gvt1.com |
| unknown |
clients2.googleusercontent.com |
| whitelisted |
r1---sn-25ge7nzd.gvt1.com |
| unknown |
www.google.com |
| whitelisted |