File name:

ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe

Full analysis: https://app.any.run/tasks/7de20ad4-220e-4ad4-9104-58e643f9985c
Verdict: Malicious activity
Analysis date: March 01, 2024, 03:23:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

3BBD22C37F71BB9D66372685AB73F66B

SHA1:

0DA51CF5721B43C96AD4BD4CF5C31BD6E07A715A

SHA256:

EE983D44583999A02C6A640AEA2AE5C3C15F081C34E5074B63733E3CC09B2BB0

SSDEEP:

196608:Rcm7ySzpChz1U5SuF/dT1CqiFxLNJ9JxBmLEBzP:OOAhzC5SuYlj9pmwBzP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)

    • Create files in the Startup directory

      • cmd.exe (PID: 5292)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • cmd.exe (PID: 5248)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 7132)

    • Process drops legitimate windows executable

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • xcopy.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • xcopy.exe (PID: 2480)

    • Application launched itself

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Starts CMD.EXE for commands execution

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 5588)

    • The process checks if it is being run in the virtual environment

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Reads the date of Windows installation

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Reads the Windows owner or organization settings

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Connects to unusual port

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)

    • Reads security settings of Internet Explorer

      • rustdesk.exe (PID: 728)

    • Executing commands from a ".bat" file

      • rustdesk.exe (PID: 728)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5292)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5292)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 5292)

    • The executable file from the user directory is run by the CMD process

      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)

    • Creates a software uninstall entry

      • reg.exe (PID: 4176)
      • reg.exe (PID: 7064)
      • reg.exe (PID: 3024)
      • reg.exe (PID: 1972)
      • reg.exe (PID: 6564)
      • reg.exe (PID: 6264)
      • reg.exe (PID: 1816)
      • reg.exe (PID: 7128)
      • reg.exe (PID: 6780)
      • reg.exe (PID: 876)
      • reg.exe (PID: 5984)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 1128)

    • Searches for installed software

      • reg.exe (PID: 7064)
      • reg.exe (PID: 4176)
      • reg.exe (PID: 1972)
      • reg.exe (PID: 6264)
      • reg.exe (PID: 3024)
      • reg.exe (PID: 6564)
      • reg.exe (PID: 1816)
      • reg.exe (PID: 876)
      • reg.exe (PID: 6780)
      • reg.exe (PID: 7128)
      • reg.exe (PID: 5984)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 1128)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5292)

    • The process executes VB scripts

      • cmd.exe (PID: 5292)

    • Runs shell command (SCRIPT)

      • cscript.exe (PID: 436)
      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 6668)

    • Executes as Windows Service

      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 6452)

    • Adds/modifies Windows certificates

      • rustdesk.exe (PID: 4160)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 5292)

    • Starts itself from another location

      • rustdesk.exe (PID: 728)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7064)

  • INFO

    • Checks supported languages

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 6688)
      • chcp.com (PID: 2012)
      • chcp.com (PID: 6328)
      • rustdesk.exe (PID: 6688)
      • chcp.com (PID: 2168)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Creates files or folders in the user directory

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Reads the computer name

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Reads Windows Product ID

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Reads Environment values

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Checks proxy server information

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 1380)
      • slui.exe (PID: 6408)

    • Reads the machine GUID from the registry

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Reads product name

      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 1380)

    • Create files in a temporary directory

      • rustdesk.exe (PID: 728)
      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 436)
      • cscript.exe (PID: 6668)

    • Process checks computer location settings

      • rustdesk.exe (PID: 728)

    • Creates files in the program directory

      • cmd.exe (PID: 5292)
      • xcopy.exe (PID: 2480)

    • Drops the executable file immediately after the start

      • xcopy.exe (PID: 2480)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 6668)
      • cscript.exe (PID: 436)

    • Reads the software policy settings

      • slui.exe (PID: 6408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:11:18 00:33:44+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 332288
InitializedDataSize: 20554240
UninitializedDataSize: -
EntryPoint: 0x424e0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.4.39
ProductVersionNumber: 1.2.4.39
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: com.carriez
FileDescription: rustdesk
FileVersion: 1.2.4+39
InternalName: rustdesk
LegalCopyright: Copyright (C) 2023 com.carriez. All rights reserved.
OriginalFileName: rustdesk.exe
ProductName: rustdesk
ProductVersion: 1.2.4+39
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
80
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe taskkill.exe no specs conhost.exe no specs rustdesk.exe rustdesk.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs rustdesk.exe no specs cmd.exe conhost.exe no specs chcp.com no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs rustdesk.exe no specs reg.exe no specs chcp.com no specs xcopy.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs rustdesk.exe reg.exe no specs cmd.exe no specs rustdesk.exe no specs conhost.exe no specs cmd.exe no specs rustdesk.exe no specs conhost.exe no specs timeout.exe no specs taskkill.exe no specs rustdesk.exe rustdesk.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
436cscript "C:\Users\admin\AppData\Local\Temp\RustDesk_tray_shortcut.vbs"C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
728"C:\Users\admin\AppData\Local\rustdesk\.\rustdesk.exe" --installC:\Users\admin\AppData\Local\rustdesk\rustdesk.exe—rustdesk.exe
User:
admin
Company:
com.carriez
Integrity Level:
MEDIUM
Description:
rustdesk
Exit code:
3221225547
Version:
1.2.4+39
Modules
Images
c:\users\admin\appdata\local\rustdesk\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\users\admin\appdata\local\rustdesk\desktop_drop_plugin.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shell32.dll
756"C:\Users\admin\AppData\Local\rustdesk\.\rustdesk.exe"C:\Users\admin\AppData\Local\rustdesk\rustdesk.exe
ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe
User:
admin
Company:
com.carriez
Integrity Level:
MEDIUM
Description:
rustdesk
Exit code:
3221225547
Version:
1.2.4+39
Modules
Images
c:\users\admin\appdata\local\rustdesk\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
876reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v UninstallString /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\" --uninstall"C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
876reg add HKEY_CLASSES_ROOT\.rustdesk\shell\open\command /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1128reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v WindowsInstaller /t REG_DWORD /d 0C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1128reg add HKEY_CLASSES_ROOT\rustdesk /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1156"taskkill" /F /IM RuntimeBroker_rustdesk.exeC:\Windows\System32\taskkill.exe—ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1304reg add HKEY_CLASSES_ROOT\rustdesk\shell\open\command /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
Total events
21 878
Read events
21 844
Write events
32
Delete events
2

Modification events

(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4176) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayIcon
Value:
C:\Program Files\RustDesk\RustDesk.exe
(PID) Process:(7064) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayName
Value:
RustDesk
(PID) Process:(2604) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayVersion
Value:
1.2.4
(PID) Process:(1972) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:Version
Value:
1.2.4
(PID) Process:(6264) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:BuildDate
Value:
2023-11-18 00:22
(PID) Process:(3024) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:InstallLocation
Value:
C:\Program Files\RustDesk
Executable files
35
Suspicious files
26
Text files
168
Unknown types
11

Dropped files

PID
Process
Filename
Type
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\app.so —
MD5:—
SHA256:—
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\desktop_drop_plugin.dllexecutable
MD5:8285D6C3B2D89A68D6D52C3EECDED7CA
SHA256:09DB635DAA9DA7FC4A2AD070EE61331C0CAC5D1F6CB0DB4A5144149294F7D66B
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dllexecutable
MD5:D3FECEA627CDA20B3A969807B55F2784
SHA256:96A3CC71D828D36CE76EA5CAB03B7B4DA7F482CB306373A6859BF6304712638E
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\flutter_windows.dllexecutable
MD5:FB644CCB65912CEC65362B9A6D17D0DB
SHA256:5E5AF315EB738F1B1001CC469B9E834BC62AFC762B39706D66734F1D340B5989
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\rustdesk.exeexecutable
MD5:237E7DE32DE7412B326A255FE1755EC7
SHA256:58F70BAA17B882EB7A6BBD9C66C8D78FEC61A4AF9415EDBA13A907C46E6A4E74
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.jsonbinary
MD5:1C8250AFB2523DCD4EC6728D7CA964CD
SHA256:337AB8D87321626E87F273F973E7E0ED35A621D727178ABF9940035CB869EC12
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dllexecutable
MD5:1E47C91A40412CD9412051530C41961B
SHA256:3B7E6FE79C2475E03856A0A21365A986E148F307BC564575B6207FBA33A61D72
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\window_manager_plugin.dllexecutable
MD5:B4C6AECFCBF6E7567F182B2D450FD9A9
SHA256:FF9D28EE42CCAE7B9F062A7999844317B38AFD48100393299DCDD725C6E5EA1E
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\WindowInjection.dllexecutable
MD5:B396E159D5551178A1DD814CD6787545
SHA256:942D3A595FE15985088D030AC97B449B2DBED0550577DDA3896EC88BD71957E1
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\window_size_plugin.dllexecutable
MD5:B1E5D49FABDE0E019B2D2D1DEAA702E0
SHA256:1AD1A842D900EFEF7BE22CC30960056EBACA4981A028058CF30998A76730DD53
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
40
DNS requests
14
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5444
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
5928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2464
svchost.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
884
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5444
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6896
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5928
svchost.exe
20.190.160.17:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5928
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
756
rustdesk.exe
108.61.171.103:21116
rs-ny.rustdesk.com
AS-CHOOPA
DE
unknown
756
rustdesk.exe
108.61.171.103:21115
rs-ny.rustdesk.com
AS-CHOOPA
DE
unknown
5444
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
rs-ny.rustdesk.com
  • 108.61.171.103
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
github.com
  • 140.82.121.4
shared
www.bing.com
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.131
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2136
svchost.exe
Misc activity
ET INFO RustDesk Domain in DNS Lookup
2136
svchost.exe
Misc activity
ET INFO RustDesk Relay Domain in DNS Lookup
756
rustdesk.exe
Misc activity
ET INFO RustDesk Register Public Key
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe