File name:

AnyDesk.exe

Full analysis: https://app.any.run/tasks/7f3e5a19-ce05-4b7f-b1d6-d2c66ce426b4
Verdict: Malicious activity
Analysis date: January 26, 2024, 00:33:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

75EECC3A8B215C465F541643E9C4F484

SHA1:

3AD1F800B63640128BFDCC8DBEE909554465EE11

SHA256:

EC33D8EE9C3881B8FCEA18F9F862D5926D994553AEC1B65081D925AFD3E8B028

SSDEEP:

98304:xEhZCn2N8X+7A2qiwQPq5jGbmUX4j98EjlWipPUQAD0hrKKnpdZYki3qe3Bv9PRi:uPqKJ1K/rSOr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)

    • Create files in the Startup directory

      • AnyDesk.exe (PID: 2820)
      • regsvr32.exe (PID: 4012)

    • Creates a writable file in the system directory

      • AnyDesk.exe (PID: 1348)

    • Steals credentials from Web Browsers

      • taskhost.exe (PID: 980)
      • setup.exe (PID: 1696)

    • Changes the autorun value in the registry

      • unregmp2.exe (PID: 2980)
      • regsvr32.exe (PID: 4012)

    • Antivirus name has been found in the command line (generic signature)

      • unregmp2.exe (PID: 2980)

  • SUSPICIOUS

    • Application launched itself

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 1348)
      • ie4uinit.exe (PID: 3436)
      • rundll32.exe (PID: 948)
      • setup.exe (PID: 1696)

    • Reads the Internet Settings

      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 3360)
      • ie4uinit.exe (PID: 3436)
      • rundll32.exe (PID: 948)
      • taskhost.exe (PID: 980)
      • rundll32.exe (PID: 3640)
      • ie4uinit.exe (PID: 2496)
      • ie4uinit.exe (PID: 2812)

    • Connects to unusual port

      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 1408)

    • Executable content was dropped or overwritten

      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)

    • Executes as Windows Service

      • AnyDesk.exe (PID: 1408)
      • EOSNotify.exe (PID: 3776)
      • taskhost.exe (PID: 980)
      • EOSNotify.exe (PID: 908)

    • Searches for installed software

      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 1388)
      • AnyDesk.exe (PID: 992)

    • Creates a software uninstall entry

      • AnyDesk.exe (PID: 1408)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 548)

    • Reads Internet Explorer settings

      • ie4uinit.exe (PID: 3436)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 3436)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 3436)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 3436)
      • rundll32.exe (PID: 948)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 3436)
      • unregmp2.exe (PID: 2980)
      • regsvr32.exe (PID: 4012)

    • Changes default file association

      • unregmp2.exe (PID: 2980)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 548)

  • INFO

    • Reads the computer name

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2292)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 1388)
      • setup.exe (PID: 2860)
      • setup.exe (PID: 3808)
      • IMEKLMG.EXE (PID: 1560)
      • IMEKLMG.EXE (PID: 3596)
      • AnyDesk.exe (PID: 992)
      • wmpnscfg.exe (PID: 1624)
      • wmpnscfg.exe (PID: 3712)

    • Checks supported languages

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 2712)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 2292)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3360)
      • AnyDesk.exe (PID: 3380)
      • AnyDesk.exe (PID: 3852)
      • AnyDesk.exe (PID: 120)
      • AnyDesk.exe (PID: 4080)
      • AnyDesk.exe (PID: 1348)
      • AnyDesk.exe (PID: 1388)
      • setup.exe (PID: 1696)
      • setup.exe (PID: 2860)
      • setup.exe (PID: 3808)
      • IMEKLMG.EXE (PID: 1560)
      • IMEKLMG.EXE (PID: 3596)
      • AnyDesk.exe (PID: 992)
      • IMKRMIG.EXE (PID: 2384)
      • wmpnscfg.exe (PID: 1624)
      • wmpnscfg.exe (PID: 3712)

    • Process checks whether UAC notifications are on

      • AnyDesk.exe (PID: 1036)
      • IMEKLMG.EXE (PID: 1560)
      • IMEKLMG.EXE (PID: 3596)

    • Reads the machine GUID from the registry

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 3432)

    • Creates files or folders in the user directory

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 452)

    • Reads CPU info

      • AnyDesk.exe (PID: 1036)
      • AnyDesk.exe (PID: 3432)

    • Creates files in the program directory

      • AnyDesk.exe (PID: 2820)
      • AnyDesk.exe (PID: 1408)
      • AnyDesk.exe (PID: 120)
      • ie4uinit.exe (PID: 3436)
      • chrmstp.exe (PID: 2928)
      • chrmstp.exe (PID: 116)
      • setup.exe (PID: 2860)
      • setup.exe (PID: 1696)
      • setup.exe (PID: 3808)

    • Manual execution by a user

      • AnyDesk.exe (PID: 3432)
      • AnyDesk.exe (PID: 3380)
      • ie4uinit.exe (PID: 3436)
      • unregmp2.exe (PID: 2980)
      • ie4uinit.exe (PID: 2496)
      • ie4uinit.exe (PID: 2812)
      • chrmstp.exe (PID: 116)
      • regsvr32.exe (PID: 4012)
      • setup.exe (PID: 1696)
      • IMEKLMG.EXE (PID: 3596)
      • IMEKLMG.EXE (PID: 1560)
      • AnyDesk.exe (PID: 992)
      • wmpnscfg.exe (PID: 1624)
      • wmpnscfg.exe (PID: 3712)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 3436)
      • sipnotify.exe (PID: 548)

    • Application launched itself

      • chrmstp.exe (PID: 116)
      • chrmstp.exe (PID: 2928)
      • msedge.exe (PID: 3768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:09 08:48:10+01:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 10752
InitializedDataSize: 5496832
UninitializedDataSize: 19445760
EntryPoint: 0x1ce5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.6.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AnyDesk Software GmbH
FileDescription: AnyDesk
FileVersion: 8.0.6
ProductName: AnyDesk
ProductVersion: 8
LegalCopyright: (C) 2022 AnyDesk Software GmbH
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
48
Malicious processes
11
Suspicious processes
5

Behavior graph

Click at the process to see the details
start anydesk.exe no specs anydesk.exe anydesk.exe no specs anydesk.exe no specs anydesk.exe anydesk.exe anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs anydesk.exe no specs eosnotify.exe no specs anydesk.exe no specs anydesk.exe no specs Profile Notification Host no specs taskhost.exe anydesk.exe no specs sipnotify.exe ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs ie4uinit.exe no specs unregmp2.exe ie4uinit.exe no specs regsvr32.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe setup.exe no specs setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs imeklmg.exe no specs msedge.exe no specs imeklmg.exe no specs anydesk.exe no specs imkrmig.exe no specs Thumbnail Cache Out of Proc Server no specs eosnotify.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-levelC:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe—explorer.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\109.0.5414.120\installer\chrmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shell32.dll
120"C:\Program Files\AnyDesk\AnyDesk.exe" --backendC:\Program Files\AnyDesk\AnyDesk.exe—AnyDesk.exe
User:
SYSTEM
Company:
AnyDesk Software GmbH
Integrity Level:
SYSTEM
Description:
AnyDesk
Exit code:
0
Version:
8.0.6
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
316"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc4,0xc8,0xcc,0x98,0xd4,0x6f3af598,0x6f3af5a8,0x6f3af5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
452"C:\Users\admin\AppData\Local\Temp\AnyDesk.exe" --local-serviceC:\Users\admin\AppData\Local\Temp\AnyDesk.exe
AnyDesk.exe
User:
admin
Company:
AnyDesk Software GmbH
Integrity Level:
MEDIUM
Description:
AnyDesk
Exit code:
9099
Version:
8.0.6
Modules
Images
c:\users\admin\appdata\local\temp\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
548C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
900C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
908C:\Windows\system32\EOSNotify.exe C:\Windows\System32\EOSNotify.exe—services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\windows\system32\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
948C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /mC:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
980"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
992"C:\Program Files\AnyDesk\AnyDesk.exe" --controlC:\Program Files\AnyDesk\AnyDesk.exe—explorer.exe
User:
Administrator
Company:
AnyDesk Software GmbH
Integrity Level:
HIGH
Description:
AnyDesk
Exit code:
0
Version:
8.0.6
Modules
Images
c:\program files\anydesk\anydesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
23 910
Read events
23 062
Write events
841
Delete events
7

Modification events

(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1036) AnyDesk.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2820) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayName
Value:
AnyDesk
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:DisplayVersion
Value:
ad 8.0.6
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionMajor
Value:
8
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionMinor
Value:
0
(PID) Process:(1408) AnyDesk.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Operation:writeName:VersionBuild
Value:
6
Executable files
13
Suspicious files
86
Text files
75
Unknown types
1

Dropped files

PID
Process
Filename
Type
1036AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AFFHT3VQHBTTSBDEVDKZ.tempbinary
MD5:6FC4DF2DFBA2A27CAFAD3D7D28A88D47
SHA256:CC33D29C66E215AED8BEB82606A82CB0001FFAE3138CB3CB081318715A911801
1036AnyDesk.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-msbinary
MD5:6FC4DF2DFBA2A27CAFAD3D7D28A88D47
SHA256:CC33D29C66E215AED8BEB82606A82CB0001FFAE3138CB3CB081318715A911801
452AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\service.conftext
MD5:6DF20C9042767097FF3F78D6C44CCD18
SHA256:3EC3C0FBD3FD79341716EAE729C6012B9BC8AC382F7232F807198A280A4768F0
452AnyDesk.exeC:\Users\admin\AppData\Local\Temp\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
452AnyDesk.exeC:\Users\admin\AppData\Roaming\AnyDesk\system.conftext
MD5:0C04AD1083DC5C7C45E3EE2CD344AE38
SHA256:6452273C017DB7CBE0FFC5B109BBF3F8D3282FB91BFA3C5EABC4FB8F1FC98CB0
2820AnyDesk.exeC:\ProgramData\AnyDesk\service.conftext
MD5:9690B09458E72CE7C1F3E9B7B1277764
SHA256:E3BCDF7C3A91086920DC1036441A202E8C7D0BB7C530315DF37DD3003E020D29
2820AnyDesk.exeC:\Program Files\AnyDesk\AnyDesk.exeexecutable
MD5:75EECC3A8B215C465F541643E9C4F484
SHA256:EC33D8EE9C3881B8FCEA18F9F862D5926D994553AEC1B65081D925AFD3E8B028
2820AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnkbinary
MD5:AE765CD860CA58751284A48B3CBC9A6D
SHA256:BE445B7CE9293930F15B411C7FCEA8CEC5956C2420F896DBA4D2F56D036ACE26
2820AnyDesk.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyDesk\Uninstall AnyDesk.lnkbinary
MD5:0AA965FD653CBF186E0AFE5B80E5451D
SHA256:0EB65C49ECF117DBFD486EDFF9F2378354AC314BF8ED1703BB76EBD7BF8FA713
1408AnyDesk.exeC:\Windows\TEMP\gcapi.dllexecutable
MD5:1CE7D5A1566C8C449D0F6772A8C27900
SHA256:73170761D6776C0DEBACFBBC61B6988CB8270A20174BF5C049768A264BB8FFAF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
92
DNS requests
7
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
548
sipnotify.exe
HEAD
200
23.210.119.212:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133507029499270000
unknown
—
—
unknown
—
—
POST
200
18.245.86.79:80
http://api.playanext.com/httpapi
unknown
—
—
unknown
548
sipnotify.exe
GET
200
23.210.119.212:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133507029499270000
unknown
compressed
78.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
452
AnyDesk.exe
49.12.130.236:443
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
49.12.130.236:80
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
49.12.130.236:6568
boot.net.anydesk.com
Hetzner Online GmbH
DE
unknown
452
AnyDesk.exe
208.115.231.38:443
relay-acbffbf3.net.anydesk.com
LIMESTONENETWORKS
US
unknown
—
—
192.168.100.91:49173
—
—
—
unknown
452
AnyDesk.exe
10.26.167.43:7070
—
—
—
unknown
452
AnyDesk.exe
173.20.44.6:56188
—
MEDIACOM-ENTERPRISE-BUSINESS
US
unknown
452
AnyDesk.exe
173.20.44.6:7070
—
MEDIACOM-ENTERPRISE-BUSINESS
US
unknown
1408
AnyDesk.exe
208.115.231.38:443
relay-acbffbf3.net.anydesk.com
LIMESTONENETWORKS
US
unknown

DNS requests

Domain
IP
Reputation
boot.net.anydesk.com
  • 49.12.130.236
unknown
relay-acbffbf3.net.anydesk.com
  • 208.115.231.38
unknown
relay-10d0d168.net.anydesk.com
  • 208.115.231.206
unknown
query.prod.cms.rt.microsoft.com
  • 23.210.119.212
whitelisted
relay-48ce591e.net.anydesk.com
  • 208.115.231.102
unknown
api.playanext.com
  • 18.245.86.105
  • 18.245.86.26
  • 18.245.86.84
  • 18.245.86.79
whitelisted

Threats

PID
Process
Class
Message
452
AnyDesk.exe
Misc activity
ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software)
—
—
Potential Corporate Privacy Violation
ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AnyDesk.exe