File name:

ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe

Full analysis: https://app.any.run/tasks/7de20ad4-220e-4ad4-9104-58e643f9985c
Verdict: Malicious activity
Analysis date: March 01, 2024, 03:23:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

3BBD22C37F71BB9D66372685AB73F66B

SHA1:

0DA51CF5721B43C96AD4BD4CF5C31BD6E07A715A

SHA256:

EE983D44583999A02C6A640AEA2AE5C3C15F081C34E5074B63733E3CC09B2BB0

SSDEEP:

196608:Rcm7ySzpChz1U5SuF/dT1CqiFxLNJ9JxBmLEBzP:OOAhzC5SuYlj9pmwBzP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)

    • Create files in the Startup directory

      • cmd.exe (PID: 5292)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • xcopy.exe (PID: 2480)

    • Process drops legitimate windows executable

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • xcopy.exe (PID: 2480)

    • Uses TASKKILL.EXE to kill process

      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • cmd.exe (PID: 5248)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 7132)

    • Application launched itself

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Starts CMD.EXE for commands execution

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 5588)

    • The process checks if it is being run in the virtual environment

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Reads the Windows owner or organization settings

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Reads the date of Windows installation

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Reads security settings of Internet Explorer

      • rustdesk.exe (PID: 728)

    • Connects to unusual port

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5292)

    • Executing commands from a ".bat" file

      • rustdesk.exe (PID: 728)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5292)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 5292)

    • The executable file from the user directory is run by the CMD process

      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)

    • Searches for installed software

      • reg.exe (PID: 4176)
      • reg.exe (PID: 7064)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 1972)
      • reg.exe (PID: 6264)
      • reg.exe (PID: 3024)
      • reg.exe (PID: 6564)
      • reg.exe (PID: 7128)
      • reg.exe (PID: 6780)
      • reg.exe (PID: 876)
      • reg.exe (PID: 5984)
      • reg.exe (PID: 1816)
      • rustdesk.exe (PID: 6688)
      • reg.exe (PID: 1128)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Creates a software uninstall entry

      • reg.exe (PID: 4176)
      • reg.exe (PID: 7064)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 6264)
      • reg.exe (PID: 6780)
      • reg.exe (PID: 1816)
      • reg.exe (PID: 6564)
      • reg.exe (PID: 7128)
      • reg.exe (PID: 876)
      • reg.exe (PID: 5984)
      • reg.exe (PID: 1972)
      • reg.exe (PID: 3024)
      • reg.exe (PID: 1128)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5292)

    • The process executes VB scripts

      • cmd.exe (PID: 5292)

    • Runs shell command (SCRIPT)

      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 6668)
      • cscript.exe (PID: 436)

    • Executes as Windows Service

      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 6452)

    • Adds/modifies Windows certificates

      • rustdesk.exe (PID: 4160)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 5292)

    • Starts itself from another location

      • rustdesk.exe (PID: 728)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7064)

  • INFO

    • Checks supported languages

      • rustdesk.exe (PID: 756)
      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 728)
      • chcp.com (PID: 6328)
      • rustdesk.exe (PID: 6688)
      • chcp.com (PID: 2012)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • chcp.com (PID: 2168)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 4156)
      • rustdesk.exe (PID: 2532)

    • Reads the computer name

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 6452)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 5248)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Creates files or folders in the user directory

      • rustdesk.exe (PID: 756)
      • ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe (PID: 5260)
      • rustdesk.exe (PID: 4412)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 6688)
      • rustdesk.exe (PID: 4160)
      • rustdesk.exe (PID: 1380)
      • rustdesk.exe (PID: 2532)
      • rustdesk.exe (PID: 4156)

    • Reads Windows Product ID

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Reads Environment values

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 1380)

    • Checks proxy server information

      • rustdesk.exe (PID: 756)
      • slui.exe (PID: 6408)
      • rustdesk.exe (PID: 1380)

    • Reads the machine GUID from the registry

      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 5588)
      • rustdesk.exe (PID: 1380)

    • Reads product name

      • rustdesk.exe (PID: 728)
      • rustdesk.exe (PID: 756)
      • rustdesk.exe (PID: 1380)

    • Create files in a temporary directory

      • rustdesk.exe (PID: 728)
      • cscript.exe (PID: 436)
      • cscript.exe (PID: 6668)
      • cscript.exe (PID: 2124)

    • Process checks computer location settings

      • rustdesk.exe (PID: 728)

    • Creates files in the program directory

      • cmd.exe (PID: 5292)
      • xcopy.exe (PID: 2480)

    • Drops the executable file immediately after the start

      • xcopy.exe (PID: 2480)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 436)
      • cscript.exe (PID: 6668)

    • Reads the software policy settings

      • slui.exe (PID: 6408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:11:18 00:33:44+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 332288
InitializedDataSize: 20554240
UninitializedDataSize: -
EntryPoint: 0x424e0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.4.39
ProductVersionNumber: 1.2.4.39
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: com.carriez
FileDescription: rustdesk
FileVersion: 1.2.4+39
InternalName: rustdesk
LegalCopyright: Copyright (C) 2023 com.carriez. All rights reserved.
OriginalFileName: rustdesk.exe
ProductName: rustdesk
ProductVersion: 1.2.4+39
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
80
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe taskkill.exe no specs conhost.exe no specs rustdesk.exe rustdesk.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs rustdesk.exe no specs cmd.exe conhost.exe no specs chcp.com no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs rustdesk.exe no specs reg.exe no specs chcp.com no specs xcopy.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs chcp.com no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs rustdesk.exe no specs rustdesk.exe reg.exe no specs cmd.exe no specs rustdesk.exe no specs conhost.exe no specs cmd.exe no specs rustdesk.exe no specs conhost.exe no specs timeout.exe no specs taskkill.exe no specs rustdesk.exe rustdesk.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
436cscript "C:\Users\admin\AppData\Local\Temp\RustDesk_tray_shortcut.vbs"C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
728"C:\Users\admin\AppData\Local\rustdesk\.\rustdesk.exe" --installC:\Users\admin\AppData\Local\rustdesk\rustdesk.exe—rustdesk.exe
User:
admin
Company:
com.carriez
Integrity Level:
MEDIUM
Description:
rustdesk
Exit code:
3221225547
Version:
1.2.4+39
Modules
Images
c:\users\admin\appdata\local\rustdesk\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\users\admin\appdata\local\rustdesk\desktop_drop_plugin.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shell32.dll
756"C:\Users\admin\AppData\Local\rustdesk\.\rustdesk.exe"C:\Users\admin\AppData\Local\rustdesk\rustdesk.exe
ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe
User:
admin
Company:
com.carriez
Integrity Level:
MEDIUM
Description:
rustdesk
Exit code:
3221225547
Version:
1.2.4+39
Modules
Images
c:\users\admin\appdata\local\rustdesk\rustdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
876reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v UninstallString /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\" --uninstall"C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
876reg add HKEY_CLASSES_ROOT\.rustdesk\shell\open\command /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1128reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v WindowsInstaller /t REG_DWORD /d 0C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1128reg add HKEY_CLASSES_ROOT\rustdesk /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1156"taskkill" /F /IM RuntimeBroker_rustdesk.exeC:\Windows\System32\taskkill.exe—ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1304reg add HKEY_CLASSES_ROOT\rustdesk\shell\open\command /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
Total events
21 878
Read events
21 844
Write events
32
Delete events
2

Modification events

(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(728) rustdesk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4176) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayIcon
Value:
C:\Program Files\RustDesk\RustDesk.exe
(PID) Process:(7064) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayName
Value:
RustDesk
(PID) Process:(2604) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:DisplayVersion
Value:
1.2.4
(PID) Process:(1972) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:Version
Value:
1.2.4
(PID) Process:(6264) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:BuildDate
Value:
2023-11-18 00:22
(PID) Process:(3024) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk
Operation:writeName:InstallLocation
Value:
C:\Program Files\RustDesk
Executable files
35
Suspicious files
26
Text files
168
Unknown types
11

Dropped files

PID
Process
Filename
Type
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\app.so —
MD5:—
SHA256:—
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\desktop_drop_plugin.dllexecutable
MD5:8285D6C3B2D89A68D6D52C3EECDED7CA
SHA256:09DB635DAA9DA7FC4A2AD070EE61331C0CAC5D1F6CB0DB4A5144149294F7D66B
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dllexecutable
MD5:98483A84CF654953BB248B47484CFA7B
SHA256:1C076CA22763FB20A45A288D441B29C70EE05739F2668EFB6AFB7E54CA4A1AFD
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dllexecutable
MD5:D3FECEA627CDA20B3A969807B55F2784
SHA256:96A3CC71D828D36CE76EA5CAB03B7B4DA7F482CB306373A6859BF6304712638E
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.binbinary
MD5:002B5638865D866FA93C2A3AD176B5D1
SHA256:717CE6C1E49FA785974D3D59E53DF492F61112D3339B1A955C46856D0F845250
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\flutter_assets\AssetManifest.jsonbinary
MD5:1C8250AFB2523DCD4EC6728D7CA964CD
SHA256:337AB8D87321626E87F273F973E7E0ED35A621D727178ABF9940035CB869EC12
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\data\icudtl.datbinary
MD5:CF772CF9F6CA67F592FE47DA2A15ADB1
SHA256:AC44CCC3F61BF630BB20FB8043D86CFE4C8995D06B460084400DB45D70497B30
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\window_size_plugin.dllexecutable
MD5:B1E5D49FABDE0E019B2D2D1DEAA702E0
SHA256:1AD1A842D900EFEF7BE22CC30960056EBACA4981A028058CF30998A76730DD53
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\screen_retriever_plugin.dllexecutable
MD5:67CB40E2637E41B519D1619BE3D6B462
SHA256:3C537768F16F344A141687DE39BB91BD05B71FFEF2D2A3E03345F44311813E3A
5260ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exeC:\Users\admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dllexecutable
MD5:721CB805D53C7477589E4C34C4BB1B78
SHA256:A6D554CFBA31D9519C2A1631D51C9637FB9924266A7A91E6C990722ADC0C873E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
40
DNS requests
14
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
5444
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
884
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
2464
svchost.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5444
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6896
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5928
svchost.exe
20.190.160.17:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5928
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
756
rustdesk.exe
108.61.171.103:21116
rs-ny.rustdesk.com
AS-CHOOPA
DE
unknown
756
rustdesk.exe
108.61.171.103:21115
rs-ny.rustdesk.com
AS-CHOOPA
DE
unknown
5444
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
rs-ny.rustdesk.com
  • 108.61.171.103
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
github.com
  • 140.82.121.4
shared
www.bing.com
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.131
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2136
svchost.exe
Misc activity
ET INFO RustDesk Domain in DNS Lookup
2136
svchost.exe
Misc activity
ET INFO RustDesk Relay Domain in DNS Lookup
756
rustdesk.exe
Misc activity
ET INFO RustDesk Register Public Key
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ee983d44583999a02c6a640aea2ae5c3c15f081c34e5074b63733e3cc09b2bb0.exe