File name:

AnyDesk.exe

Full analysis: https://app.any.run/tasks/7f3e5a19-ce05-4b7f-b1d6-d2c66ce426b4
Verdict: Malicious activity
Analysis date: January 26, 2024, 00:33:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

75EECC3A8B215C465F541643E9C4F484

SHA1:

3AD1F800B63640128BFDCC8DBEE909554465EE11

SHA256:

EC33D8EE9C3881B8FCEA18F9F862D5926D994553AEC1B65081D925AFD3E8B028

SSDEEP:

98304:xEhZCn2N8X+7A2qiwQPq5jGbmUX4j98EjlWipPUQAD0hrKKnpdZYki3qe3Bv9PRi:uPqKJ1K/rSOr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)

    • Create files in the Startup directory

      • AnyDesk.exe (PID: 2820)
      • regsvr32.exe (PID: 4012)

    • Creates a writable file in the system directory

      • AnyDesk.exe (PID: 1348)

    • Steals credentials from Web Browsers

      • taskhost.exe (PID: 980)
      • setup.exe (PID: 1696)

    • Antivirus name has been found in the command line (generic signature)

      • unregmp2.exe (PID: 2980)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 2980)
      • regsvr32.exe (PID: 4012)

  • SUSPICIOUS

    • Application launched itself

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 1408)
      • ie4uinit.exe (PID: 3436)
      • AnyDesk.exe (PID: 1348)
      • rundll32.exe (PID: 948)
      • setup.exe (PID: 1696)

    • Reads the Internet Settings

      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 3360)
      • ie4uinit.exe (PID: 3436)
      • ie4uinit.exe (PID: 2496)
      • taskhost.exe (PID: 980)
      • rundll32.exe (PID: 948)
      • rundll32.exe (PID: 3640)
      • ie4uinit.exe (PID: 2812)

    • Connects to unusual port

      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 1408)

    • Executable content was dropped or overwritten

      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)

    • Executes as Windows Service

      • AnyDesk.exe (PID: 1408)
      • EOSNotify.exe (PID: 3776)
      • taskhost.exe (PID: 980)
      • EOSNotify.exe (PID: 908)

    • Searches for installed software

      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1388)
      • AnyDesk.exe (PID: 992)

    • Creates a software uninstall entry

      • AnyDesk.exe (PID: 1408)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 548)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 3436)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3436)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3436)

    • Changes default file association

      • unregmp2.exe (PID: 2980)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 3436)
      • rundll32.exe (PID: 948)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3436)
      • unregmp2.exe (PID: 2980)
      • regsvr32.exe (PID: 4012)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 548)

  • INFO

    • Creates files or folders in the user directory

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)

    • Checks supported languages

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2292)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 1388)
      • setup.exe (PID: 1696)
      • setup.exe (PID: 2860)
      • IMEKLMG.EXE (PID: 1560)
      • IMKRMIG.EXE (PID: 2384)
      • AnyDesk.exe (PID: 992)
      • setup.exe (PID: 3808)
      • IMEKLMG.EXE (PID: 3596)
      • wmpnscfg.exe (PID: 1624)
      • wmpnscfg.exe (PID: 3712)

    • Process checks whether UAC notifications are on

      • AnyDesk.exe (PID: 1036)
      • IMEKLMG.EXE (PID: 3596)
      • IMEKLMG.EXE (PID: 1560)

    • Reads the computer name

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 2292)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 1388)
      • setup.exe (PID: 2860)
      • setup.exe (PID: 3808)
      • IMEKLMG.EXE (PID: 3596)
      • IMEKLMG.EXE (PID: 1560)
      • AnyDesk.exe (PID: 992)
      • wmpnscfg.exe (PID: 1624)
      • wmpnscfg.exe (PID: 3712)

    • Reads the machine GUID from the registry

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 2820)

    • Reads CPU info

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 3432)

    • Creates files in the program directory

      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 120)
      • ie4uinit.exe (PID: 3436)
      • chrmstp.exe (PID: 116)
      • chrmstp.exe (PID: 2928)
      • setup.exe (PID: 3808)
      • setup.exe (PID: 2860)
      • setup.exe (PID: 1696)

    • Manual execution by a user

      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3432)
      • ie4uinit.exe (PID: 3436)
      • ie4uinit.exe (PID: 2496)
      • unregmp2.exe (PID: 2980)
      • ie4uinit.exe (PID: 2812)
      • chrmstp.exe (PID: 116)
      • regsvr32.exe (PID: 4012)
      • setup.exe (PID: 1696)
      • IMEKLMG.EXE (PID: 1560)
      • IMEKLMG.EXE (PID: 3596)
      • AnyDesk.exe (PID: 992)
      • wmpnscfg.exe (PID: 3712)
      • wmpnscfg.exe (PID: 1624)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 3436)
      • sipnotify.exe (PID: 548)

    • Application launched itself

      • chrmstp.exe (PID: 2928)
      • chrmstp.exe (PID: 116)
      • msedge.exe (PID: 3768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:09 08:48:10+01:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 5496832
UninitializedDataSize: 19445760
EntryPoint: 0x1ce5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.6.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 8.0.6
ProductName: AnyDesk
ProductVersion: 8
LegalCopyright: (C) 2022 AnyDesk Software GmbH
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
48
Malicious processes
11
Suspicious processes
5

Behavior graph

Click at the process to see the details
start anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe no specs anydesk.exe anydesk.exe anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs eosnotify.exe no specs anydesk.exe no specs anydesk.exe no specs Profile Notification Host no specs taskhost.exe anydesk.exe no specs sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs msedge.exe no specs imeklmg.exe no specs anydesk.exe no specs imkrmig.exe no specs Thumbnail Cache Out of Proc Server no specs eosnotify.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-levelC:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe—explorer.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\109.0.5414.120\installer\chrmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shell32.dll
120"C:\Program Files\AnyDesk\AnyDesk.exe" --backendC:\Program Files\AnyDesk\AnyDesk.exe—AnyDesk.exe
User:
SYSTEM
Company:
AnyDesk Software GmbH
Integrity Level:
SYSTEM
Description:
AnyDesk
Exit code:
0
Version:
8.0.6
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
316"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc4,0xc8,0xcc,0x98,0xd4,0x6f3af598,0x6f3af5a8,0x6f3af5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
452"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --local-serviceC:\Users\admin\AppData\Local\Temp\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.6
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
548C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
900C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
908C:\Windows\system32\EOSNotify.exe C:\Windows\System32\EOSNotify.exe—services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\windows\system32\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
948C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /mC:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
980"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
992"C:\Program Files\AnyDesk\AnyDesk.exe" --controlC:\Program Files\AnyDesk\AnyDesk.exe—explorer.exe
User:
Administrator
Company:
AnyDesk Software GmbH
Integrity Level:
HIGH
Description:
AnyDesk
Exit code:
0
Version:
8.0.6
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
23 910
Read events
23 062
Write events
841
Delete events
7

Modification events

(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2820) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayName
Value:
AnyDesk
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayVersion
Value:
ad 8.0.6
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionMajor
Value:
8
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionMinor
Value:
0
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionBuild
Value:
6
Executable files
13
Suspicious files
86
Text files
75
Unknown types
1

Dropped files

PID
Process
Filename
Type
1036AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\user.conftext
MD5:A787C308BD30D6D844E711D7579BE552
SHA256:8A395011A6A877D3BDD53CC8688EF146160DAB9D42140EB4A70716AD4293A440
1036AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AFFHT3VQHBTTSBDEVDKZ.tempbinary
MD5:6FC4DF2DFBA2A27CAFAD3D7D28A88D47
SHA256:CC33D29C66E215AED8BEB82606A82CB0001FFAE3138CB3CB081318715A911801
3432AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:F3F6CDD4A56182A6BB052C41225A40D7
SHA256:A25F48B8CC33DB8A9503CB1ED0E579A54BBAA998F20D071B83B67F3E1585E4C6
2820AnyDesk.exeC:\Program Files\AnyDesk\AnyDesk.exeexecutable
MD5:75EECC3A8B215C465F541643E9C4F484
SHA256:EC33D8EE9C3881B8FCEA18F9F862D5926D994553AEC1B65081D925AFD3E8B028
2820AnyDesk.exeC:\Users\Public\Desktop\AnyDesk.lnkbinary
MD5:A9CA692CEE1AD5453021C57C66DA236E
SHA256:3C2D4F879D9F63B996C055F1D2E11AAB1D19A795C1875198E7BB5A879DBBD0B3
2820AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk\AnyDesk.lnkbinary
MD5:E59CC2FE60A2FA2492B3733549CF05D6
SHA256:F5F22EA8B65442455965C00A324946E9C331C61FE3B2128A78453FDBA4B8DDFA
452AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\connection_trace.txtbinary
MD5:4F2F0F01E5DA317817A2E38C44A742C1
SHA256:1011AC8C7831483C03A4D3946F879D301A2C19EDCFF23EA451C88AE6F0250049
2820AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnkbinary
MD5:AE765CD860CA58751284A48B3CBC9A6D
SHA256:BE445B7CE9293930F15B411C7FCEA8CEC5956C2420F896DBA4D2F56D036ACE26
3432AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms~RF15a61d.TMPbinary
MD5:6FC4DF2DFBA2A27CAFAD3D7D28A88D47
SHA256:CC33D29C66E215AED8BEB82606A82CB0001FFAE3138CB3CB081318715A911801
452AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\system.conftext
MD5:0C04AD1083DC5C7C45E3EE2CD344AE38
SHA256:6452273C017DB7CBE0FFC5B109BBF3F8D3282FB91BFA3C5EABC4FB8F1FC98CB0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
92
DNS requests
7
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
548
sipnotify.exe
HEAD
200
23.210.119.212:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133507029499270000
unknown
—
—
unknown
—
—
POST
200
18.245.86.79:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
548
sipnotify.exe
GET
200
23.210.119.212:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133507029499270000
unknown
compressed
78.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
452
AnyDesk.exe
49.12.130.236:443
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
49.12.130.236:80
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
49.12.130.236:6568
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
208.115.231.38:443
relay-acbffbf3.net.anydesk.com
LIMESTONENETWORKS
US
unknown
—
—
192.168.100.91:49173
—
—
—
unknown
452
AnyDesk.exe
10.26.167.43:7070
—
—
—
unknown
452
AnyDesk.exe
173.20.44.6:56188
—
MEDIACOM-ENTERPRISE-BUSINESS
US
unknown
452
AnyDesk.exe
173.20.44.6:7070
—
MEDIACOM-ENTERPRISE-BUSINESS
US
unknown
1408
AnyDesk.exe
208.115.231.38:443
relay-acbffbf3.net.anydesk.com
LIMESTONENETWORKS
US
unknown

DNS requests

Domain
IP
Reputation
boot.net.anydesk.com
  • 49.12.130.236
unknown
relay-acbffbf3.net.anydesk.com
  • 208.115.231.38
unknown
relay-10d0d168.net.anydesk.com
  • 208.115.231.206
unknown
query.prod.cms.rt.microsoft.com
  • 23.210.119.212
whitelisted
relay-48ce591e.net.anydesk.com
  • 208.115.231.102
unknown
api.playanext.com
  • 18.245.86.105
  • 18.245.86.26
  • 18.245.86.84
  • 18.245.86.79
whitelisted

Threats

PID
Process
Class
Message
452
AnyDesk.exe
Misc activity
ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)
—
—
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk.exe