Analysis
- geolocation tags
eueuropelondonukunited-kingdom - user interaction
yes - max time kernel
150s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 17:22
Behavioral task
behavioral1
Sample
BuilderV2.exe
Resource
win11-20260130-en
windows11-21h2-x64
25 signatures
150 seconds
General
- Target BuilderV2.exe
- Size 36.3MB
- Sample260420-vxtyesa17m
- SHA256 d1e4bd97a42eae39d54f3e40c9ea33f7857db2173b2d7ab9842e21040dd4cfe4
- MD5 323a4d04b63840f2f1612fe178d55e68
- SHA1 1473b82ca86760507fe8962a2537653725203ca9
- SHA512 f509f2a1857ac5742583a2b31d0a97f732a4ab4f60826d3bea9a6562359d7c354ff3c589d467b01e30b3525283254fa732a436ccc9d2c3c03089803c1c44858f
- SSDEEP 786432:LtrhiJxZ1yUg1vM5uUi5cWVgVw+Sa5gnbxsyHph7jS/z+S3mp:OJxZ1sE5hocWVsqaGeyHrmr+Cmp
- TLSH T19387338940D055F3D4A6F13A49098474D2B2E526B920EE2F7759ABE73E0B6E34F31B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3924 netsh.exe 2276 netsh.exe 3472 netsh.exe - Creates new service(s) 2 TTPs
- Executes dropped EXE 16 IoCs
pid Process 3200 win_sys_helper.exe 32 rustdesk.exe 4776 rustdesk.exe 2516 rustdesk.exe 5116 RustDesk.exe 4644 rustdesk.exe 1268 rustdesk.exe 2884 RustDesk.exe 4572 rustdesk.exe 2464 RustDesk.exe 992 RustDesk.exe 3304 RustDesk.exe 760 win_sys_helper.exe 4380 rustdesk.exe 800 win_sys_helper.exe 3168 rustdesk.exe - Loads dropped DLL 64 IoCs
pid Process 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 2348 BuilderV2.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 32 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 4776 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe 2516 rustdesk.exe - Stops running service(s) 4 TTPs
- Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013 RustDesk.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriverRenderFilter.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET4391.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriverRenderFilter-PipelineConfig.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriverRenderFilter.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriver.gpd DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriver.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_3D681C86BFBB3E5AC08E7973233D98C5 RustDesk.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438F.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET4391.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET437C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438E.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0971268DE7C0C567CCF1E17CBA9D78A5 RustDesk.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriver-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriverRenderFilter-PipelineConfig.xml DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013 RustDesk.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriver-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET4390.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET4390.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\rustdeskprinterdriver.inf_amd64_e87266c5208a07ea\RustDeskPrinterDriver.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_3D681C86BFBB3E5AC08E7973233D98C5 RustDesk.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET438D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\RustDeskPrinterDriver.gpd DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4077cee2-5b7a-8048-bce5-22f5fa7919b2}\SET437C.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0971268DE7C0C567CCF1E17CBA9D78A5 RustDesk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\RustDesk\data\flutter_assets\assets\file.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\secure.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\rec.svg xcopy.exe File created C:\Program Files\RustDesk\uni_links_desktop_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\icudtl.dat xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\chat.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\folder_new.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\icon.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\insecure_relay.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\linux.svg xcopy.exe File created C:\Program Files\RustDesk\usbmmidd_v2\x64\usbmmIdd.dll xcopy.exe File created C:\Program Files\RustDesk\librustdesk.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\android.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\checkbox-outline.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\dots.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\secure_relay.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\dash_chat_2\assets\placeholder.png xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\dash_chat_2\assets\profile_placeholder.png xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\window_manager\images\ic_chrome_close.png xcopy.exe File opened for modification C:\Program Files\RustDesk\screen_retriever_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\auth-okta.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\transfer.svg xcopy.exe File created C:\Program Files\RustDesk\drivers\RustDeskPrinterDriver\RustDeskPrinterDriver-manifest.ini xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\win.svg xcopy.exe File opened for modification C:\Program Files\RustDesk\RuntimeBroker_rustdesk.exe cmd.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\auth-azure.svg xcopy.exe File opened for modification C:\Program Files\RustDesk\data\flutter_assets\fonts\MaterialIcons-Regular.otf xcopy.exe File created C:\Program Files\RustDesk\flutter_windows.dll xcopy.exe File opened for modification C:\Program Files\RustDesk\uni_links_desktop_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\fullscreen.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\window_manager\images\ic_chrome_unmaximize.png xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\fullscreen_exit.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\window_manager\images\ic_chrome_maximize.png xcopy.exe File created C:\Program Files\RustDesk\Uninstall RustDesk.lnk cmd.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\actions_mobile.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\folder.svg xcopy.exe File created C:\Program Files\RustDesk\drivers\RustDeskPrinterDriver\RustDeskPrinterDriverRenderFilter.dll xcopy.exe File created C:\Program Files\RustDesk\usbmmidd_v2\License.txt xcopy.exe File created C:\Program Files\RustDesk\usbmmidd_v2\usbmmidd.cat xcopy.exe File created C:\Program Files\RustDesk\rustdesk.exe xcopy.exe File created C:\Program Files\RustDesk\url_launcher_windows_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\AssetManifest.bin xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\device_group.ttf xcopy.exe File created C:\Program Files\RustDesk\desktop_multi_window_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\trash.svg xcopy.exe File created C:\Program Files\RustDesk\drivers\RustDeskPrinterDriver\RustDeskPrinterDriver.gpd xcopy.exe File opened for modification C:\Program Files\RustDesk\data\icudtl.dat xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\auth-facebook.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\window_manager\images\ic_chrome_minimize.png xcopy.exe File created C:\Program Files\RustDesk\usbmmidd_v2\idd_instructions.txt xcopy.exe File created C:\Program Files\RustDesk\RuntimeBroker_rustdesk.exe xcopy.exe File opened for modification C:\Program Files\RustDesk\data\app.so xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\auth-google.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\close.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\gestures.ttf xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\packages\flex_color_picker\assets\opacity.png xcopy.exe File created C:\Program Files\RustDesk\usbmmidd_v2\usbmmIdd.inf xcopy.exe File created C:\Program Files\RustDesk\window_size_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\texture_rgba_renderer_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\call_end.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\kb_layout_iso.svg xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\assets\voice_call_waiting.svg xcopy.exe File created C:\Program Files\RustDesk\flutter_gpu_texture_renderer_plugin.dll xcopy.exe File created C:\Program Files\RustDesk\data\flutter_assets\AssetManifest.json xcopy.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\server\RustDesk_rCURRENT.log RustDesk.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(2)_1776705795446248300 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(11)_1776705806140474500 RustDesk.exe File opened for modification C:\Windows\INF\setupapi.dev.log rustdesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\check-hwcodec-config\RustDesk_rCURRENT.log RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.2464_ThreadId(16)_1776705794966547300 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(2)_1776705795491076100 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.2464_ThreadId(29)_1776705795608747200 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(11)_1776705805440936200 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk_hwcodec.2464_ThreadId(11)_1776705794990178100 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(2)_1776705795402939000 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(31)_1776705795407829500 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.2464_ThreadId(2)_1776705795445722300 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.2464_ThreadId(2)_1776705795489006600 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\import-config\RustDesk_rCURRENT.log RustDesk.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.2464_ThreadId(16)_1776705795095133300 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk2.2464_ThreadId(11)_1776705805441480000 RustDesk.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\service\RustDesk_rCURRENT.log RustDesk.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2088 sc.exe 1844 sc.exe 3160 sc.exe 3860 sc.exe 3680 sc.exe 1872 sc.exe 4004 sc.exe 4916 sc.exe 3828 sc.exe 3564 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 rustdesk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID rustdesk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID rustdesk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 rustdesk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe - Kills process with taskkill 6 IoCs
pid Process 1400 taskkill.exe 1216 taskkill.exe 4104 taskkill.exe 4108 taskkill.exe 1864 taskkill.exe 1488 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70 RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f14040000000100000010000000d386d4056a495dd632c4c9c8be8574060f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust RustDesk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open\command reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\DefaultIcon\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open\command\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\DESKTOPSHORTCUTS = "1" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open\command\ = "\"C:\\Program Files\\RustDesk\\RustDesk.exe\" --play \"%1\"" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open\command\ = "\"C:\\Program Files\\RustDesk\\RustDesk.exe\" \"%1\"" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\STARTMENUSHORTCUTS = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\ reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\URL Protocol reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open\command reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open\command\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\DefaultIcon reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\PRINTER = "1" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\DefaultIcon\ = "\"C:\\Program Files\\RustDesk\\RustDesk.exe\",0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rustdesk\shell\open\command reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\ reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rustdesk\shell\open\command reg.exe - Modifies system certificate store 2 TTPs 18 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e rustdesk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D RustDesk.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70 rustdesk.exe Key created \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692 rustdesk.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692\Blob = 030000000100000014000000329b78a5c9ebc2043242de90ce1b7c6b1ba6c69214000000010000001400000032eb929aff3596482f284042702036915c1785e60400000001000000100000002aa320982e00193fad3bd0ea5406e4cd0f0000000100000030000000a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a41900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000730500003082056f30820457a003020102021048fc93b46055948d36a7c98a89d69416300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3231303532353030303030305a170d3238313233313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a38201123082010e301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070303301b0603551d200414301230060604551d20003008060667810c01040130430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010012bfa1ef8b749a9844b86946b5ab240a0ca48a67b83a81bf458a7d5207a88d1f4e218539a36b5e2d2086bf10b8ae793b53cdb4fbd844be06d95c6367d44016874486722ad63215f51283c2f9e15d114067f6422772c523e202381a4c20e2db01f7cd464f26a27c66c05136b6890254c7fc58fb6c00eefe98a62e95a10c53291f6fd819a64f9ef7ac09ea5d82c68baf80a7bd8148528431da32ec15e4a64c3d6c3973d40b853920e0851a68e1a74838a9d1362577c18d1916c5884c667d2f63ce98e869dfac3ca85d9dc91c5baed8f32f74cfb87ef6d7839d1196629aae4513da7fdc47fbdfc3529fe60655e99d8cf23a6251bcec240f29d4588084e4457b5ad8 rustdesk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 040000000100000010000000d79917c9aaf881346040f8afd3960af60f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2 RustDesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 5c0000000100000004000000001000001900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be040000000100000010000000d79917c9aaf881346040f8afd3960af620000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2 RustDesk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 0f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2 rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2 rustdesk.exe Set value (data) \REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f14040000000100000010000000d386d4056a495dd632c4c9c8be8574060f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf rustdesk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rustdesk.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4644 rustdesk.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4644 rustdesk.exe 4644 rustdesk.exe 2884 RustDesk.exe 2884 RustDesk.exe 2464 RustDesk.exe 2464 RustDesk.exe 2464 RustDesk.exe 3304 RustDesk.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 1216 taskkill.exe Token: SeDebugPrivilege 4104 taskkill.exe Token: SeDebugPrivilege 4108 taskkill.exe Token: SeAuditPrivilege 3196 svchost.exe Token: SeSecurityPrivilege 3196 svchost.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 1488 taskkill.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4644 rustdesk.exe 3304 RustDesk.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3304 RustDesk.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 rustdesk.exe 4644 rustdesk.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 2348 3852 BuilderV2.exe 80 PID 2348 wrote to memory of 3024 2348 BuilderV2.exe 81 PID 3024 wrote to memory of 3200 3024 cmd.exe 83 PID 3200 wrote to memory of 1400 3200 win_sys_helper.exe 84 PID 3200 wrote to memory of 32 3200 win_sys_helper.exe 87 PID 32 wrote to memory of 3944 32 rustdesk.exe 88 PID 3944 wrote to memory of 4132 3944 cmd.exe 90 PID 3944 wrote to memory of 2088 3944 cmd.exe 91 PID 3944 wrote to memory of 1872 3944 cmd.exe 92 PID 3944 wrote to memory of 1216 3944 cmd.exe 93 PID 3944 wrote to memory of 4104 3944 cmd.exe 94 PID 3944 wrote to memory of 4692 3944 cmd.exe 95 PID 3944 wrote to memory of 3812 3944 cmd.exe 96 PID 3944 wrote to memory of 3472 3944 cmd.exe 97 PID 3944 wrote to memory of 4776 3944 cmd.exe 98 PID 3944 wrote to memory of 1268 3944 cmd.exe 149 PID 3944 wrote to memory of 2516 3944 cmd.exe 100 PID 3944 wrote to memory of 3376 3944 cmd.exe 101 PID 3944 wrote to memory of 1592 3944 cmd.exe 102 PID 3944 wrote to memory of 1212 3944 cmd.exe 103 PID 3944 wrote to memory of 484 3944 cmd.exe 104 PID 3944 wrote to memory of 4880 3944 cmd.exe 105 PID 3944 wrote to memory of 4128 3944 cmd.exe 106 PID 3944 wrote to memory of 3332 3944 cmd.exe 107 PID 3944 wrote to memory of 2380 3944 cmd.exe 108 PID 3944 wrote to memory of 3836 3944 cmd.exe 109 PID 3944 wrote to memory of 2160 3944 cmd.exe 110 PID 3944 wrote to memory of 3748 3944 cmd.exe 111 PID 3944 wrote to memory of 1156 3944 cmd.exe 112 PID 3944 wrote to memory of 1464 3944 cmd.exe 113 PID 3944 wrote to memory of 2716 3944 cmd.exe 114 PID 3944 wrote to memory of 3564 3944 cmd.exe 153 PID 3944 wrote to memory of 3680 3944 cmd.exe 154 PID 3944 wrote to memory of 3248 3944 cmd.exe 117 PID 3944 wrote to memory of 1688 3944 cmd.exe 118 PID 3944 wrote to memory of 324 3944 cmd.exe 119 PID 3944 wrote to memory of 4004 3944 cmd.exe 120 PID 3944 wrote to memory of 1844 3944 cmd.exe 121 PID 3944 wrote to memory of 4916 3944 cmd.exe 122 PID 3944 wrote to memory of 3828 3944 cmd.exe 123 PID 3944 wrote to memory of 3160 3944 cmd.exe 125 PID 3944 wrote to memory of 3860 3944 cmd.exe 126 PID 3944 wrote to memory of 2356 3944 cmd.exe 127 PID 3944 wrote to memory of 3452 3944 cmd.exe 128 PID 3944 wrote to memory of 3752 3944 cmd.exe 129 PID 3944 wrote to memory of 2176 3944 cmd.exe 131 PID 3944 wrote to memory of 4608 3944 cmd.exe 132 PID 3944 wrote to memory of 644 3944 cmd.exe 133 PID 3944 wrote to memory of 5036 3944 cmd.exe 134 PID 3944 wrote to memory of 1400 3944 cmd.exe 135 PID 3944 wrote to memory of 804 3944 cmd.exe 163 PID 3944 wrote to memory of 244 3944 cmd.exe 137 PID 3944 wrote to memory of 3952 3944 cmd.exe 138 PID 3944 wrote to memory of 3736 3944 cmd.exe 139 PID 3944 wrote to memory of 4556 3944 cmd.exe 140 PID 3944 wrote to memory of 564 3944 cmd.exe 142 PID 3944 wrote to memory of 1736 3944 cmd.exe 143 PID 3944 wrote to memory of 3632 3944 cmd.exe 144 PID 3944 wrote to memory of 3116 3944 cmd.exe 146 PID 3944 wrote to memory of 3924 3944 cmd.exe 147 PID 4644 wrote to memory of 2288 4644 rustdesk.exe 148 PID 4644 wrote to memory of 1268 4644 rustdesk.exe 149 PID 2288 wrote to memory of 4108 2288 cmd.exe 151 PID 3944 wrote to memory of 2276 3944 cmd.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\BuilderV2.exe"C:\Users\Admin\AppData\Local\Temp\BuilderV2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\BuilderV2.exe"C:\Users\Admin\AppData\Local\Temp\BuilderV2.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --silent-install"3⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\ProgramData\WindowsAppIndex\win_sys_helper.exe"C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --silent-install4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --silent-install5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\RustDesk_install.bat6⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\system32\chcp.comchcp 650017⤵PID:4132
-
-
C:\Windows\system32\sc.exesc stop RustDesk7⤵
- Launches sc.exe
PID:2088
-
-
C:\Windows\system32\sc.exesc delete RustDesk7⤵
- Launches sc.exe
PID:1872
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RustDesk.exe /FI "PID ne 32"7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\system32\reg.exereg delete HKEY_CLASSES_ROOT\.rustdesk /f7⤵PID:4692
-
-
C:\Windows\system32\reg.exereg delete HKEY_CLASSES_ROOT\rustdesk /f7⤵PID:3812
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="RustDesk Service"7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3472
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --uninstall-cert7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4776
-
-
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f7⤵PID:1268
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --uninstall-amyuni-idd7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:2516
-
-
C:\Windows\system32\chcp.comchcp 650017⤵PID:3376
-
-
C:\Windows\system32\xcopy.exeXCOPY "C:\Users\Admin\AppData\Local\rustdesk" "C:\Program Files\RustDesk" /Y /E /H /C /I /K /R /Z7⤵
- Drops file in Program Files directory
PID:1592
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f7⤵PID:1212
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v DisplayIcon /t REG_SZ /d "C:\Program Files\RustDesk\RustDesk.exe"7⤵PID:484
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v DisplayName /t REG_SZ /d "RustDesk"7⤵PID:4880
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v DisplayVersion /t REG_SZ /d "1.4.6"7⤵PID:4128
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v Version /t REG_SZ /d "1.4.6"7⤵PID:3332
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v BuildDate /t REG_SZ /d "2026-03-05 05:37"7⤵PID:2380
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v InstallLocation /t REG_SZ /d "C:\Program Files\RustDesk"7⤵PID:3836
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v Publisher /t REG_SZ /d "RustDesk"7⤵PID:2160
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v VersionMajor /t REG_DWORD /d 17⤵PID:3748
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v VersionMinor /t REG_DWORD /d 47⤵PID:1156
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v VersionBuild /t REG_DWORD /d 67⤵PID:1464
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v UninstallString /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\" --uninstall"7⤵PID:2716
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v EstimatedSize /t REG_DWORD /d 753487⤵PID:3564
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RustDesk /f /v WindowsInstaller /t REG_DWORD /d 07⤵PID:3680
-
-
C:\Windows\system32\cscript.execscript "C:\Users\Admin\AppData\Local\Temp\RustDesk_mk_shortcut.vbs"7⤵PID:3248
-
-
C:\Windows\system32\cscript.execscript "C:\Users\Admin\AppData\Local\Temp\RustDesk_uninstall_shortcut.vbs"7⤵PID:1688
-
-
C:\Windows\system32\cscript.execscript "C:\Users\Admin\AppData\Local\Temp\RustDesk_tray_shortcut.vbs"7⤵PID:324
-
-
C:\Windows\system32\sc.exesc stop RustDesk7⤵
- Launches sc.exe
PID:4004
-
-
C:\Windows\system32\sc.exesc delete RustDesk7⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\system32\sc.exesc create RustDesk binpath= "\"C:\Program Files\RustDesk\RustDesk.exe\" --import-config \"C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk.toml\"" start= auto DisplayName= "RustDesk Service"7⤵
- Launches sc.exe
PID:4916
-
-
C:\Windows\system32\sc.exesc start RustDesk7⤵
- Launches sc.exe
PID:3828
-
-
C:\Windows\system32\sc.exesc stop RustDesk7⤵
- Launches sc.exe
PID:3160
-
-
C:\Windows\system32\sc.exesc delete RustDesk7⤵
- Launches sc.exe
PID:3860
-
-
C:\Windows\system32\chcp.comchcp 650017⤵PID:2356
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk /f7⤵
- Modifies registry class
PID:3452
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk /f /v DESKTOPSHORTCUTS /t REG_SZ /d "1"7⤵
- Modifies registry class
PID:3752
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk /f /v STARTMENUSHORTCUTS /t REG_SZ /d "1"7⤵
- Modifies registry class
PID:2176
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk /f /v PRINTER /t REG_SZ /d "1"7⤵
- Modifies registry class
PID:4608
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\DefaultIcon /f7⤵
- Modifies registry class
PID:644
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\DefaultIcon /f /ve /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\",0"7⤵
- Modifies registry class
PID:5036
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\shell /f7⤵
- Modifies registry class
PID:1400
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\shell\open /f7⤵
- Modifies registry class
PID:804
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\shell\open\command /f7⤵
- Modifies registry class
PID:244
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.rustdesk\shell\open\command /f /ve /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\" --play \"%1\""7⤵
- Modifies registry class
PID:3952
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk /f7⤵
- Modifies registry class
PID:3736
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk /f /v "URL Protocol" /t REG_SZ /d ""7⤵
- Modifies registry class
PID:4556
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk\shell /f7⤵
- Modifies registry class
PID:564
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk\shell\open /f7⤵
- Modifies registry class
PID:1736
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk\shell\open\command /f7⤵
- Modifies registry class
PID:3632
-
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\rustdesk\shell\open\command /f /ve /t REG_SZ /d "\"C:\Program Files\RustDesk\RustDesk.exe\" \"%1\""7⤵
- Modifies registry class
PID:3116
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="RustDesk Service" dir=out action=allow program="C:\Program Files\RustDesk\RustDesk.exe" enable=yes7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3924
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="RustDesk Service" dir=in action=allow program="C:\Program Files\RustDesk\RustDesk.exe" enable=yes7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2276
-
-
C:\Windows\system32\sc.exesc create RustDesk binpath= "\"C:\Program Files\RustDesk\RustDesk.exe\" --service" start= auto DisplayName= "RustDesk Service"7⤵
- Launches sc.exe
PID:3564
-
-
C:\Windows\system32\sc.exesc start RustDesk7⤵
- Launches sc.exe
PID:3680
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v SoftwareSASGeneration /t REG_DWORD /d 17⤵PID:3556
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --install-remote-printer7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4572
-
-
-
C:\Program Files\RustDesk\RustDesk.exe"C:\Program Files\RustDesk\RustDesk.exe" --tray6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3304
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --password Loewakaccess321"3⤵PID:1292
-
C:\ProgramData\WindowsAppIndex\win_sys_helper.exe"C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --password Loewakaccess3214⤵
- Executes dropped EXE
PID:760 -
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --password Loewakaccess3215⤵
- Executes dropped EXE
PID:4380
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --get-id"3⤵PID:1748
-
C:\ProgramData\WindowsAppIndex\win_sys_helper.exe"C:\ProgramData\WindowsAppIndex\win_sys_helper.exe" --get-id4⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --get-id5⤵
- Executes dropped EXE
PID:3168
-
-
-
-
-
C:\Program Files\RustDesk\RustDesk.exe"C:\Program Files\RustDesk\RustDesk.exe" --import-config "C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk.toml"1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5116
-
C:\PROGRA~1\RustDesk\rustdesk.exeC:\PROGRA~1\RustDesk\rustdesk.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
-
C:\PROGRA~1\RustDesk\rustdesk.exe"C:\PROGRA~1\RustDesk\rustdesk.exe" --check-hwcodec-config2⤵
- Executes dropped EXE
PID:1268
-
-
C:\Program Files\RustDesk\RustDesk.exe"C:\Program Files\RustDesk\RustDesk.exe" --service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Program Files\RustDesk\RustDesk.exe"C:\Program Files\RustDesk\RustDesk.exe" --server2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2464 -
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"3⤵PID:776
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
C:\Program Files\RustDesk\RustDesk.exe"C:\Program Files\RustDesk\RustDesk.exe" --check-hwcodec-config3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:992
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3196 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriver.inf" "9" "4eec051db" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "C:\Users\Admin\AppData\Local\rustdesk\drivers/RustDeskPrinterDriver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:804
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\RustDesk\Uninstall RustDesk.lnk
- Size 1KB
- SHA256 7e0a767c51e740f3c56e968c0cb8407f685543dec0c3274b31e66df3be90e1f9
- MD5 dc6ac192adaf6e0f73cc280aeecab05a
- SHA1 d45805c5f3cb9512974c3189e577d79917c11a77
- SHA512 145414d7a14c55a3df4e23233b40559cd82deb7230e6ccf7e0f9f8af83022f5f1912bfcafb416e743374c341f85433bb519f5a37989fda4d65a5d1eb3d67e4d8
- TLSH T112119C254BD22726D3F59638E9721712C7227C86DA251F5F81C5424918B5A00FAE8E6D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RustDesk\RustDesk.lnk
- Size 1001B
- SHA256 1acfdc10956a9369ea131bf1f6e7ba1d40ebd788f0dfe1097cf9c312ce5be631
- MD5 f9fdbecd84b07ea27d27cd393f04ebd9
- SHA1 264923e55b73c3c80aea684221a9df893dbf96ec
- SHA512 89661d52d3b801e2400254763bc64629fd82c9be3df825d089eaaf63cff4643db2d574d0a803f8c9d34078d8914700806bdf3d23771df6496579d4003e65cf61
- TLSH T12911AF2907923726D3F59639D5B31712C7227887EA251F5F81C592491CB4600F6E8E6D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\WindowsAppIndex\win_sys_helper.exe
- Size 23.1MB
- SHA256 422ce31131e6537ea4f611ebf4a4d1804f28a6f58c83aa05065071c5958f1551
- MD5 c9738bd576992e70aa812ef076bacc51
- SHA1 de2a3556987a1b69e7fc55f17346722b432899da
- SHA512 49c02976cc7b6b9d144a1861ccf3e4973238fdf1e4675fa635c3f286c109c29d63120115cf7d8fd2a9e54e89fb6575aef6c031b58f3569ec70d7eb8f1f7db461
- SSDEEP 393216:nZ+sy8LygPvg4x4OU85aNwX71EeNibe3lQorb4YVb0PUZ8kfzwgDf6ZXOYN5:nsT6yg3g4x7ExjCb42b5BzxyZXOYf
- TLSH T16A373345F18555FAE42BC43082064931AA77BCB69B217DBFA09835653F3EEE05F38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_asyncio.pyd
- Size 76KB
- SHA256 48fdd95938c43b8b3e1f6312de651a53d459e8e2c754fbbdf48e99f5caa1f55b
- MD5 3a6186022e5487f7088370c9ade4595c
- SHA1 0284e6fcce3034555f1809e01e525c2f5bb17a9b
- SHA512 11597e7b6091cacb5fca16ca9c718326233788d4ed9435d43f2d766f09f60716ea63c9b88768d857245f4bd1ee9c4667ee55c76f55c1ab6f87c951a98fa6907b
- SSDEEP 1536:sm6uk+xO/OpCvE/8h340gI1DnHQyvcvR9SfIkubo:sm+/OpCvEkh340gI1Dn0H
- TLSH T1C6737D87A2A44186EEF79134CB536FC3FBB1F1915A10939F5194C18E2F533A18BBA721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_bz2.pyd
- Size 85KB
- SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
- MD5 a0946ac3236b70d27de6046ccc467977
- SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
- SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
- SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
- TLSH T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_cffi_backend.cp314-win_amd64.pyd
- Size 177KB
- SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
- MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
- SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
- SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
- SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
- TLSH T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_ctypes.pyd
- Size 139KB
- SHA256 f8a9f7831e81b2bfba12456e589f8198114f24986bd527ac231a844565afcddb
- MD5 03fb3055ed0c56155bbf030596726e03
- SHA1 fba03bbf844c08ccf20854d717a84fa62ab291fd
- SHA512 9ba8f50f75b37858b3d81d6f7323ae981ae21f57a9897955142bc53098ad74c8ae119e61ccd0bb5cd0071e092e8c2bbb5c146688e29f2cf7d1d3740f47ec9117
- SSDEEP 3072:HDpx2Lp7KRmFrkdOJWWcovIMzTF4FyxpEI1GPny:jpxCdK8r8WDvIMn+8xpx
- TLSH T160D37E4B736841A6DA678138C6739E47EBB1F452261087CF4264C99B1F633A2AF3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_decimal.pyd
- Size 283KB
- SHA256 04738ee6b96bcc6351446b011b523d831aa88ec3f11d4b64c33414c965b56b80
- MD5 bd5ca697bd7da2b805a8372f879dc4d3
- SHA1 41e0bb70c6d08fd646fe0100068dacc4d1a4ace8
- SHA512 248fe22d992c68912c31988a7ef6a71cbdd18c7facc4e620eb6c09c78a5b4b7e37adfaf10f4461fffed73fd73f211d9f428e7a60960558be13e992c855e31b15
- SSDEEP 6144:n6TEZDpJodlvNDRfAT8GqqM43fIWeA5tMo:n6TaDpJcdND4jKo
- TLSH T1AC547D57A2490CA4EF778434CA479A5BF7B2B8414360D78F42A48AA72F933A3377D744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_hashlib.pyd
- Size 67KB
- SHA256 d4524b261f09806a828c62fc97e8517328b23d65ab87d20706a4bafd86bbf345
- MD5 3c7f5536fd531f5115738cad734ba92d
- SHA1 aaafd1ee00d2da6bdbaad00ef78f8fdf99865f5e
- SHA512 492e61def2ec6b01d0df0c55887a7273adc7fb8bb216a6a9bceda9556546fcebde6a7175c16eac4c87ad2313d74adcfc62a571b401ad2ed9eda79217f92c56d6
- SSDEEP 1536:Bs0SOWZsPZJWvSLTRfgI1DIAyvcvR9tfIL46:WLYhJWvSLTNgI1DIpl
- TLSH T17D637B8AA6984092D62382B4C9E38F43FAB5F252270197DF6279C18D2F233C35777756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_lzma.pyd
- Size 157KB
- SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
- MD5 1dfaf924b4576f551f6dfe3cae50b230
- SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
- SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
- SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
- TLSH T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_multiprocessing.pyd
- Size 37KB
- SHA256 84a2e86428dde756e6f3e56369daf558180a30f1f7d4781cce295304e19b6fb8
- MD5 0ace2b6b944df9590e8783b6c1e94c4f
- SHA1 989f766e6dca7c109d016fd2efb9fe215ef0ab7e
- SHA512 a39c46b1d83dc1489c29421426827fdcdea99484bf58423a1682ffb8727a36b0d016b1768969a1e4cd320360466d45f2c895df5656392e858cc75d0023cdf10d
- SSDEEP 768:RFMV/i/YybyZUlwI17tcYyvcZRYT2Ip4rOTxf1ml9dHR7L9Hc:R7/YybyZKwI17ttyvcvR9ifIbHRn9Hc
- TLSH T114037C85A6680043E5A39A30C6A3EE87F535F3871B22969F7166C1CD1F373D1736A34A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_overlapped.pyd
- Size 56KB
- SHA256 80a2f8feda9255ef611af0a28fd4df311e3cd59c3dc4eaba9a2e97bd42ddbf54
- MD5 8b7a961d382aff5a41ac81ae7d24ec1f
- SHA1 0423d4ee0c9b926272dcd431e4bf0fe9eb92d377
- SHA512 577902a11cbf2af44b5b9ce9f55a5d6f9ed699f199374196c4d411ebd2b542d081d91747a32aea7de9d25ef2d77d92e4cae51454b81dbfedf25ee23ea3eb5dba
- SSDEEP 1536:vyjKf/t3jM2PMJg4jGsL8I1CtzyvcvR95vfIbHUn9z:yJg4GG8I1Ct2TA
- TLSH T166436B09A79401D7ED73D579C6A79E47FB70B2930201931F60A8D28A1FB3792A72F385
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_queue.pyd
- Size 35KB
- SHA256 cb529f77bc4665dfa3b66fae3d00ab84de1e9618d0cb94900efbf28527623c0f
- MD5 77eae2640493cbb57e92997366ab6e7a
- SHA1 bacd865b27b8bdb9649c569b8f6ff1a758677f54
- SHA512 df81c1767dd7b87032838e8817ef6987e93e075f28f557e84c4e5f7029969b8e219bb75da8c63955ec19bdb34a3bef88936edf26ae5f2f272297fbbbdc03b2dc
- SSDEEP 768:f7wx6rEOJgBvlAEI1RUuFYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:flEOJgBvlAEI1RUuCyvcvR90fILqFrT
- TLSH T1F5F27C8AAA9C5087E6A3C930C2B2EF53F535F7D357019ADF207881891F233C1A736659
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_socket.pyd
- Size 85KB
- SHA256 ff3e97cd11bdc68798e5b3dcd5295d1efba179b7344142d50d066bbf1c2d79cd
- MD5 e60e2de0be0f2db133252f103e9b1f8d
- SHA1 686000117f1dc472ea8012a7368c936bd04ded08
- SHA512 49a002516235cec6870b0d08da61d3aac4440b4ae1437b7357fa493dfcba0b2212cbfefaf5833baa8b6f904f6439389ec3a6b53cd7faa718273ca0c3e00c38fe
- SSDEEP 1536:KcVunc70XTxn1egypxz7XP+N6wSzsGNesQAcsqIP4fYEI1GweyvcvR9YpfILO+:zEna2Dypxz7XPs6wSzsDsQ1s6fYEI1Gv
- TLSH T18D835A01AA6040F6EB72C176C6639E63FB74F5C11394A75F1066C65A1F33382BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_ssl.pyd
- Size 180KB
- SHA256 43e60bbdff2fe41701f39fa25ea6a8251a2b7623ff18f980a209a451eb5e648f
- MD5 d900bf186dc66f71d07808eeae323c17
- SHA1 9e86985f7cf11165a773a33efaff343da0e34f00
- SHA512 d3229f5da6623844b31bb4b7d93d0baa5e7c71a3b3462e5ce3679238d2d10c17ac47e758188314edc0c30a45d9fba9a08c475cc387d7d22f17aab3e5537861f4
- SSDEEP 3072:UQjyHsqUEao3kfj6CuHqMX3jYnizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnEO:MJUEV3Qj6CuJ3snOUBzCI
- TLSH T165048C47B1846AF7D913E8F9C6234543EBB4F045332297DE48D6DA860F03346AE66B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_wmi.pyd
- Size 39KB
- SHA256 5a7f3444f1c2f85fb5573bc330c1aea2c583912bb6f948ff81f8fd89a30e67be
- MD5 6fded560f9627954b2e46f0fdc9d92d8
- SHA1 6f359326458d37c266244b2ab674d3cce7a76e1c
- SHA512 f4785ef2f6b052deec4755102ec23c9e1fe7890cc4f852c70ac3fafa8b0fa25c17cdb95caee37f32fd8ff1e4e47a54f05e30b84dd40e8c19999a096e80e13bf2
- SSDEEP 768:7u2/EEqrVmjsRuJOQMVII13i0YyvcZRYT2Ip4xTxf1mlIJ2l:7TE9BEXJOQMVII13ilyvcvR9jfIk2
- TLSH T146038D89E6680093EB67CA70C5A5CE43F575F7932711878F32A581990F233D1EB3A279
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\_zstd.pyd
- Size 491KB
- SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
- MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
- SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
- SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
- SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
- TLSH T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\base_library.zip
- Size 1.3MB
- SHA256 ed8b6739e8b5c9818444b3a6555a5e4705dbcead6a4e9f7118027013f0b2d2d3
- MD5 0e2d2118b22784e20c8aee650ef856b0
- SHA1 1bfdb8c3e3d5760d489d1fbd319c2a77d34d5608
- SHA512 dc9e5d1a1a9a302c913942c217a233fa8fb2583c21872db8eddd9473d0e1ccb3d05be2b780fd662cbba1f2c2d93c4e09dd8fe6872c292962dbcf8ec5aad2ab3f
- SSDEEP 24576:JlbqtnHQeOdP2m2dfZdkLORpHx3tuUFkTV:6t/hdVRf3tuUF4
- TLSH T103552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B5A88DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\libcrypto-3.dll
- Size 5.0MB
- SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
- MD5 8e8f32ae40518478e44269cf22cf4399
- SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
- SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
- SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
- TLSH T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\libssl-3.dll
- Size 776KB
- SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
- MD5 f31ed8154564b75e48f2525a7e9f5742
- SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
- SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
- SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
- TLSH T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\pyexpat.pyd
- Size 213KB
- SHA256 b6d5142424d161039c25bea00e6acd8f7b1a5331d3994d9f3c28bd083ede159f
- MD5 657d4314e086cd69fa009888b0f3edf6
- SHA1 ed1f4296a5dbb29698c88c105c083ee83168bc0e
- SHA512 27e04996f5f10c8954a8030993dd596a51b4ec253223932ce4ab5901ccff3221385d9954356a4af6ba255bf4bdfb9ebc20a3177f5caac59582a876477db979c0
- SSDEEP 3072:oS0fqERCueJsIQT7WPczi0NAAO1+prtPqLwfW0opc0pxKWBoDYrDcDQhD7DfDBDE:NanRMs9fWPcihAO1+prMRTrhjba/t
- TLSH T1B2247D9BB260C1E7D853813CE6968B13DAB1B86603909BCF52C4E77C9F2B7513B29315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\python3.dll
- Size 72KB
- SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
- MD5 8d3d1ffbe3bb9539402e8bccb7fadcf8
- SHA1 904397a69e08c93fc2080a3cdbf6810bc40313fc
- SHA512 312fd7f95d2a76d9dd09336949d3b8ca9b53753a9f45da9d2fec128b2746f128fc1354693e0a995c1e1859a3d90497c8a4a8d4fedffc8bceee0392c456efc68a
- SSDEEP 768:IQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIU:xbTrnXngXMBEI1G0hyvcvR9NfIko
- TLSH T1C0734D5E6B54F8A2D6B629FC78D199CE242B12FC5F2984DFA47CD3D20D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\python314.dll
- Size 6.4MB
- SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
- MD5 5bc0adc1fed509f353832bde6b2add62
- SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
- SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
- SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
- TLSH T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\select.pyd
- Size 32KB
- SHA256 05734bd352ce60c944d474aa62468cc5eebf400097f1d9d0c453d37aed26fcca
- MD5 bb2472e8821fce27ee535db0aeb667ca
- SHA1 b1329b16873db0f667a5b1ff6b2570cf5cb009ba
- SHA512 c1a973e9509f407bcff6288b11011647e168f6b1e71fefa9f1859e98c3db08e266a5e0d833ed912ffa33626cb2c8aeda7be336bdd128cb5a8022ffcab3289ff4
- SSDEEP 768:0B7YWHfVEaqFEI1RGTYyvcZRYT2Ip4U8ITxf1ml9dHv7L9mEY:0B7b/CaqFEI1RGUyvcvR9UrfIbHvn9W
- TLSH T169E28D8AAB385047E6A3CA71C6A2DE43FA39F7A3565146DF31B991890E173C0B337354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\unicodedata.pyd
- Size 740KB
- SHA256 4445b894f836e89a8b9fdcc88b5e59fbc76aca805baaf40aeb69e869978d4e6d
- MD5 e521fd8d69046ac8edee6d9f5d9ae80b
- SHA1 b1593ef202bb2ca2041567e986c01bc281a4697c
- SHA512 7326988e782c7c8cd547300168e26ccc19905ad387c612fd042024e0a5e45b8575b1d4fb27ee9c0385c791786f703fca384764d62280e1785f27d54b7bf4f66a
- SSDEEP 12288:jYxAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtfy:jYi5ZmDPqO5ElDJPTMfy
- TLSH T1F2F4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI38522\zstandard\backend_c.cp314-win_amd64.pyd
- Size 510KB
- SHA256 da3beaa10d453d8af37f650d04e031f2d83004c05d77d540b46407f8beda2e4f
- MD5 2ac9d16ec417fb26ece089d593f2ec67
- SHA1 c5a0e74ece38eb294a4ffa7cfef5488c6c6a7d6e
- SHA512 a7701e6700a82011e48eed41088932114ebd91606311f49929a8f0f477702985b12c18e7e462cc51c00dbdb76d5117203837868543591c634def1607c8c77863
- SSDEEP 12288:wiaJVF/6s9zTp6XiayP39P1DJtK9LTsJmWwzb:wlSsT6XiayPtP1DMQ+
- TLSH T12AB48D43F29953EDD13BC478CA6A9627FBB27409131466EF82D4DB613F13BA1963A700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriver-manifest.ini
- Size 274B
- SHA256 c8f6f96e7a3d2e09703ab8a33271d534903c5c3c8b04049f0e8fe58c9107f6af
- MD5 2fa13b210e349ca21467f61a6989228d
- SHA1 7f83838b332f8c40b842e598b53c27823cd9fc03
- SHA512 6e9e9baf3070ba6a05dab3b1cf4d50e5ed8619c54c5d1d87654fed5db076b74a483ca488a83dec3f000873a8f8db385d455e3d9026be29ed06953976f18c1a76
- TLSH T1E4D02B5F591F7C9D7781028140968C88675F1A28E0BE000073EC875AC0EF4CDD11DB0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriver.cat
- Size 12KB
- SHA256 bde22161590885d54155e133c6bb5d8b3cfe86d6a98d4acebd298559a0dacdda
- MD5 f209e28bbc440ed0edff17322d72743b
- SHA1 d673bf542e928c9518dab5ea2bf306697e9ddc32
- SHA512 d9567e5f4f3bc725653b13b1b294d07b775db144d12f450e521d385874d1ec66d4189439a3d5920a2407ad39ad716435213c63757e984a6f73bcff02d6fc6047
- SSDEEP 192:IxUQ3PDtRsynJCqZmE4ByKVb1FWQFWuxOwGOr49uX01k9z3AzxLOga:I6iLSEopFRF4wGOrjR9zExL6
- TLSH T1474208EA49BD0583F8A7997047E8E4937C386BD76800586E22E7F7640DA33C5F71842D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriver.gpd
- Size 67KB
- SHA256 ed48709c194f3d32603c99af0607b566639f0bb198d721a3e43af29ad76630f6
- MD5 61e856d7d9bca01d03809d4c8207310e
- SHA1 6976b80f3474f74a7c259bad84b394f76d81f4cb
- SHA512 a883b70157abcc10b156dfc4463d1c3d2cb9f4968345b3f0611c2f6a3bf904d26616bb2f8725f852dd12a37c1a06c3da3e1fbc1813e857d9ba187cf48cfe8ba2
- SSDEEP 768:Rl513+/TLYbpmS1Gx5M7ytzk9wjKS0ff8sEOxPOwhKGhBmAAGFD4iaKhvmOaoGJG:xvJ
- TLSH T13263814E29C02C8506BBEABF97B308C9E667193B85F9E478759EB5B40FBD4009175E0C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriver.inf
- Size 2KB
- SHA256 0fa8a0ed1a2de622386c0dacf024217489a0f158acdb21cb71b8d5736f25692d
- MD5 65f280a185a96a0e22d4a74e67a564d6
- SHA1 cc3f3827793ef523a863881608f6f057f4f52cd6
- SHA512 d78f3c1eefaad214c8b25bb6dbba7dadc57cfe8e0aea41ac2b501aeff03cf5c45056b85f32bd35362976942a733a81c8385ab4568b6c0e6c76f746c744559668
- TLSH T16B516D17D7DC1624F2F24E80EBF40975DA527CA25E78D41E52E0505E26F0D90E8F2BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriverRenderFilter-PipelineConfig.xml
- Size 455B
- SHA256 435a7f4cf6e2fb449ac34d5b15bca7d77cf7f837752a3389c5d90266f7287d54
- MD5 5b587b6d932be155eba0781ef0c81b32
- SHA1 1f343ff685b8d497ad224eb386d3479a252c84f3
- SHA512 1e8aac068cb8390aec6b13bad9ab7b376b1eaa32613a9f42f22668f7f88b241336264e4a0ce544909a7306295e6616747d7555b93d9698cf751c539940033e83
- TLSH T189F06179D1F29C5511724411FE328905C335C4C621712643B11D8ACE4F73569C15931E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{c6fcfc1b-1d8a-ae4c-8818-c7bbc9045cfb}\RustDeskPrinterDriverRenderFilter.dll
- Size 40KB
- SHA256 43ede110ffb779ec6f28339a11945414696ce55253f7826d5dbb64e9633506cd
- MD5 e2a9408682ad5f7c6930d1109d230d2f
- SHA1 da4cafeeebcca8ee70bc58311cbb75a60a75413d
- SHA512 989f86bbcad266f035f1182cb6f6ad2149ccdee60f7f19da0ea32012a084bfd4b2c4e6de38ddb84fb5338190c196c2f0518056df3a69d63208ead9341eda5d29
- SSDEEP 768:fUl55VwAJvRSwj2OdN9fNYVgotg8au3jIT9zh:fgRwAJvILOj9VYCotg8aaM5zh
- TLSH T19D136D82BB7C05C9D4679134C2A3DF03E97AB996072196CF5360C26E0E373E4DE39A56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\RuntimeBroker_rustdesk.exe
- Size 129KB
- SHA256 032233b9effcaf9a5446687ff76885ce2f69c89a277fd3bef36c3abe763f29e9
- MD5 b2050c10311377b83b278e9514d7fdfa
- SHA1 34f7fd750777dd86485e9fca0ee6e7b648036ceb
- SHA512 df9481dfb45790d84f7ef868334c30be33c1887b60439c77f30efaad28dfd8414cc08a87a85c33809718bc69749cabe0e65efbb173f48cec82c8a451eb68ec9f
- SSDEEP 1536:157mJ2Oj4oFbSQCYwh0aw0ckaWO22u3E53NLyX7Winj3fGdddQhddd2ddsRyP/M6:1ZhOjJo0awXk6+EviTfu/MdSCe2W/9
- TLSH T1AFD37C6A66E820D8D13B527CC5C28306F771B429170157DF02E0C1BA1F67BE9AE3AF91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
- Size 330KB
- SHA256 be81b1c468bc09ce19ff3c60f93d7bcaf96ffc04fcf13d10b9d0c1e6ae0fe772
- MD5 c7c3f73c4c75cec6b6b3869e71ee6858
- SHA1 ad332cf21c121d57ccd8a9b91f3aaced326e46e1
- SHA512 1aa0193d04e3c88a0911b7a9a52343090b82a4930c8e133ba61fb659b8faf41f48fc088213f76b6bd73de9332be5d7a630f95d8c8be8d0226fb28af02539b0eb
- SSDEEP 6144:1R4/9uCIvoqJivCriaariRQiKPl0EyceSAFIm:1RvCIRi6DaG2iKPlRyBSAFIm
- TLSH T189745B19B7A554BAE167C53CC9A34945EBF2BC560BA0D6CB1390075A3F33BE0493E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
- Size 394KB
- SHA256 34ec912808f51647002f59c2050f429061b644311a793c1e070f41c9ca7c382a
- MD5 8e36dd29af32cf31338e0419601b25a4
- SHA1 6fc537e70aa7b871c4505fbab0debcd470dd370b
- SHA512 252bfbd30ed451bb0ad56242ab289fde84875590cc978650619ee1de4d53dc70ffddcd6fda68451e1c98b3219ebe8da436e7089289a2940307399e295d2a8958
- SSDEEP 6144:OEHBL7tynCkpHXh3mkPBBN2IGdkem5mgxEPwlMvOTn6nmFIf:R1iCkfFvN2DduxEPwlMvOT6mFIf
- TLSH T129846C2AFB6504B5E167C138C9774546DA727C8A4BA19BCF2394075A2F33FE04A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
- Size 357KB
- SHA256 ffc341d54008c77b0d352baffda7dfa0872ead4d77ac36ed0171a9869f94e3af
- MD5 5cb636e1099a9de772ecfaa670bb13eb
- SHA1 d7b0ca034f86ceb39e7b1b205844f398eabe5153
- SHA512 8aeb12f7fbec311d0f65f218ad68a0e1dac678d0960122a8439944e621ea1c23f29cbc9493d102c4c9e0e4e6bf4fda7f9e66789a55627d8adbb76ad246b8bda5
- SSDEEP 6144:dRDPe8/AlvCObbV7jMiW0zBOHpxI9z6H4x7xJsWb7xFIe8:XClvCQVjW0UpCh77xJsKxFIe8
- TLSH T19F746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
- Size 320KB
- SHA256 1d61d14e6d97d18a12441c8431e197828a440225404952be179ef745ec8b2871
- MD5 b9ea507cc85f1a224deefc6c6f52032a
- SHA1 895c334aad842f372f20ca9085958ab21753a5e1
- SHA512 4e4da628f46ab606996d79e1dad32677914628541a93a9ffdf32140e3a1c9d1bf06ee4e2a4ea364c3a084c6355dc972ba7097d8aee1fae60244d39c607738098
- SSDEEP 6144:ylvCz6DzEUctTvKfyNPEUK467qaE8gWu5pFIE:QvCz0+TGytEU67qaE8gLPFIE
- TLSH T12D645B1AF7A414BAE167813CCD974945EBF27C524BA4D6CB0390069E3F27BE44A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
- Size 352KB
- SHA256 6c907d7d38d2d693169beb6444196d446ec212ed59d9d5fcb667e2fc26d91a22
- MD5 1f349fc460c53f7cd6020802b72b5610
- SHA1 7f245b844eb057f634e2e666918de09a38ccdcd7
- SHA512 08afc4c84930135fd16f601534b741e6dcfc4ee0d29dbc16dec33560a02c8f9a3b2cad774a3dcb889a87c01b6814bac5806a2cb4c803bbc650918c8fef59ce4b
- SSDEEP 6144:/IqQVCx2DdJ9kzqMeOtvQVSUiOoEg7TgoswQFIK:7QVCxMJ+zUOWVSUiOw7TgoOFIK
- TLSH T1A4747D1AFBA454B9E167C138C9674945E7B27C460B609BCF13A40B5A2F37FE0893E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
- Size 358KB
- SHA256 3a65da1e43f629fe17ecfebab7ffdbbb3846f5efc795c1bc0ffeaf2f09c97216
- MD5 2f527a2ff497a2913781811db9b9e87f
- SHA1 0a94ae6cfcd91049537fca7f6ee0c0c581c143d8
- SHA512 65cc471fa4d8f7b19be213903f68664d4b16d9ed8e876f80b0eb8a76eca46b9637479fcb007e67b7d8f49b7e74edcbf3725762eff9f18dd754916ee98c6f67ca
- SSDEEP 6144:mebSY1I7C/kpanQo06Up3Qou01bv53m0EjW0VqYQpoFIw:cC/zL0r3QCbdm0EjW0VqYQoFIw
- TLSH T1E8747E19FBA414F9E1678538CD564945EA727C4A0BB1D7CF23940B9A2F33AE04E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
- Size 524KB
- SHA256 240fad88c14b3d7f8eb9ea11698a23f64114a03aa94322c92722e334bf56a9e5
- MD5 fa3927c3319a8ef979b2b5a4a0d1b818
- SHA1 8585dd359139a349ff6b668cb17621efae085327
- SHA512 2c1a4499d784a8d95408f5e43b7d59de5135670f91f8a4f7b8a4daca1d7e69bab8b82b3795aee49141d195e8cb7d61781d1802e9a77c0a8fdac6b217bcb8072a
- SSDEEP 6144:YvM4Cn7osApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82m9oz7w3f4sbsFI0:YpCn85AizXjjT3+LDfaoz7w3fxbsFI0
- TLSH T1AFB46C2AE6AC43B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
- Size 329KB
- SHA256 ebb8d94be6f10b512528d6fc31d020948ca2ea3289426aa6e3cd9a87c724efd7
- MD5 f83bc966c270708d0f14df0e2a0ba8ad
- SHA1 bff5e16d569fb24b4bfcd6642e0258cc27d34f78
- SHA512 d90abce576a5ace7c4f7a3234fb8a346cdf070012baaedfc65b099c5edef2d22ec64a9f561f5277bea5eaa695751dcd0add78e3c501929cf6232f28ceaacf56e
- SSDEEP 6144:2n6gHCyvN6xlody6G1iYpCyV7VMhQNXqauFI+Rm:2PCyVhybroyV7VMhQuFI+Rm
- TLSH T1D3745B19F7A914B5E167857CC9A34A46EBB27C460BA0E6CF13A0075A3F33BE0593E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config\RustDesk.toml
- Size 145B
- SHA256 2e669455652a5fd3e4c6b5cf17f863a254ea94c89e92b93b7b2a5c9b88ff003e
- MD5 588e278b4aa807434e0c5ce861a5ce8d
- SHA1 ad05f1298fede439712021c850e76e85c878ef5a
- SHA512 0b09bb8d82ad1c54a8f8f566bcbe77e7cf523999906c88c64b1734b69b98376cf6a45e92fd8cf9715e4533e29c2a97232fa8a4c2375474c45c530b6430e39469
- TLSH T169C09B4F8D2EDD05048D8711D70BD7115746657B278B17546D2DC1CD1BA94152D6144F
- MD5 SHA1 SHA512 TLSH