2ed35b0465fc3de72b0757e84daac278619edc30e651e6257073dceae5085332

Analysis

max time kernel
70s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2.exe
Size 23.0MB
Sample260805-jf78yasalg
SHA256 2ed35b0465fc3de72b0757e84daac278619edc30e651e6257073dceae5085332
MD5 c182064d535d3815dcce754a941f3b67
SHA1 cd7f44c93d97c0ee49a5641e8e84063946d12bb3
SHA512 0709d14d1b110e40f015683f1dc41fceff5218099cc31c41322b0e5b928b32f98f15be1ede0a56efabdce1374e9f7d55972f9649ef01f0853fd0699ab874677b
SSDEEP 393216:fH0oc223i/cTWHjvYyQyKXpOilBPHMddZ10YvXAwtgSAfb3W8P2DFdKK56ZwOKkj:fHTOnyEyAXhrPsddwY7m9b3W8GMK4ZwU
TLSH
T1E8373390F252197EF91B5030C5024B72E62ABCF55BB55DE701A4B3212E7EAF01F3AB49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2636	rustdesk.exe
3572	rustdesk.exe
2936	rustdesk.exe
5336	rustdesk.exe

Loads dropped DLL 56 IoCs

pid	Process
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
3572	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
2936	rustdesk.exe
3572	rustdesk.exe
2636	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe
5336	rustdesk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3628	icacls.exe
1716	icacls.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\rustdesk_rCURRENT.log	rustdesk.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_B9CEDF74FABA97FD	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2328	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
464	taskkill.exe
2804	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3572	rustdesk.exe
3572	rustdesk.exe
2636	rustdesk.exe
2636	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	taskkill.exe
Token: SeDebugPrivilege	3572	rustdesk.exe
Token: SeDebugPrivilege	2804	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	rustdesk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	rustdesk.exe
2636	rustdesk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 464	5656	2.exe	90
PID 5656 wrote to memory of 2636	5656	2.exe	93
PID 2636 wrote to memory of 3628	2636	rustdesk.exe	94
PID 2636 wrote to memory of 1716	2636	rustdesk.exe	95
PID 2636 wrote to memory of 3572	2636	rustdesk.exe	98
PID 2636 wrote to memory of 2328	2636	rustdesk.exe	99
PID 2636 wrote to memory of 2936	2636	rustdesk.exe	100
PID 2328 wrote to memory of 2804	2328	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\icacls.exe
    "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    PID:3628
- - C:\Windows\system32\icacls.exe
    "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    PID:1716
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:5336
- - C:\Windows\system32\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\RustDesk\shared_memory_portable_service
Size 23B
SHA256 ee7528a731beb2250ea3cf43c1aeb805065d583dddce64d749acfe950e844f5c
MD5 7e50402b227a0bf877fed4c17f519be2
SHA1 7846d61610a069ec26b2ebecb1937ae5345fa7f1
SHA512 3e76652aaf45b22fee09451fc283f73610e831aceddf9d9ac4d3ab7a5a41e0a7bdfcabc715fd3e72d45bf6913ebe0b7d3dbe09b3c0ed1231e7f6a33f9b2f7824
MD5 SHA1 SHA512

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
Size 12.6MB
SHA256 5f315ddefd477472dd732842defcd132f4c209548f28dcd4e796fe52f334efe6
MD5 8bc032a5658b6b107ceac468f22847b1
SHA1 796c2065d0b1e92ecd4954f02c13d46a712c7fcc
SHA512 4890b974758727947f3b68eb3317c5a837147df88e351e725a541c0b5602e4acbf4583f290a8f5eb3975d9fe704a88930625f8cf4f4aaacffdf4a55d3688407f
SSDEEP 393216:+DaPFl7uRy7VcuhoP8KW+KVuNDp74xJyXfobHvQtLzv:UwZ0Gi22W+KVqt4xJyXfostLzv
TLSH
T1B4D63A5FD4F146A0C025F6B6FB9E9BBA6A1878D84E70A18655DC0B763ED3C6007CE132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
Size 330KB
SHA256 c300d34d4f62b68b907b569f732a60e53bd59e95f7e3c0f22cb1f278b2bc2cde
MD5 837dbbaf214f97514558365d200424b3
SHA1 aa1661c557f9c4075024495a1e30a38fc879783c
SHA512 94f27cec6e3f2473555f82515b3bf3682e0d16a5f98207630795a15fcb9047e931dd54a42d795a3ba3e5d3af9c400d321748de03f5a560be9df82cfff8cb86f3
SSDEEP 6144:IIGacGCi2QMwq8mvXKrkmTKO919KPl+UZyBhgwnZv:IInCinmPvmTK419KPl/ZyHgwnZv
TLSH
T106745B19F6A914BAE167C53CC9934945EBF2BC560BA0D6CF1390065A3F37BE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_multi_window_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Size 394KB
SHA256 15d249b0ade072a1c23015ae45d8ba767ae3a5637b14ad9e095d7ed102eaa174
MD5 b7e0120bf7f23fc7afc834bbc8a4bfdd
SHA1 198175307bb40ff8d4b910280cab0423cc06bfe3
SHA512 3feb39df9d0f8abe0d86cd2695c13318334cdd11f30c89ff655e6a2747c8c8790367c8d177a15ac7aed2fe1df44634cb772c55994a80bc2426dfec64f5e31e09
SSDEEP 6144:ZvuY22WBCuxVQCc7jHBeMKqV2mTsxEPwlFdvnTX9Jn9nZz:YBCugXEMKa+xEPwlFdvnT39nZz
TLSH
T169847D2AFB6414B6E167C138C9774546EA717C8A0B619BCF2394079A6F33FE04A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
Size 357KB
SHA256 e8acd079eb832f2071801364864924d3b6769579ced0ecf414c27b5c8935dacb
MD5 f933705d1faa5c59ce612b0ceb5888c9
SHA1 f295ca57267a75206b675fed942e70af1532c18e
SHA512 67e8190c69f32b57e0e0ee01ba86150513528eba9d7ea8c8f0ef3b3ea220e6934ff0457b2536186b4ffe52c9a3855ace0c21365fa116a2936e52c967842c81bd
SSDEEP 6144:+kDn9EsoCFcjjNnmlmfPohGQ0mqkrEhT7xf3sIaYnZr:FNoCk8MfPnQxqI8T7xf3sDYnZr
TLSH
T1F4746D1AFBA814B9E1678178CDA74945EBB2BC464B60D6CF2390075A2F33FE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_custom_cursor_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
Size 320KB
SHA256 96a799ed337be7b7d754752a31cd9b4e90538244999b1eff3976a35fe13e1ad9
MD5 1ef017f010805b0bc077854865ebd054
SHA1 2f5460de34546b390d8c68875e3c7c03c0e9f50a
SHA512 a22593c19ea57b3e6bee2b26c0c9fc73fe74aaf1aadec92c45f4d52488c172ca00d3252086346b3fa518d134d929462c0b16851466dd05df3985c746385976ff
SSDEEP 6144:c028CQikHJg9SfpWS7kzx/4kW67qaEkWgbtc0unZ0o:cd8CQ/C9UW0e267qaEkWgy7nZT
TLSH
T1AE644B1AF7A514BAE167857CCD974945EBF27C520BA0D6CB0390069A3F33BE44A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_gpu_texture_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Size 352KB
SHA256 d81f5c43172326b21b5a1a2b9369a07894aa2c5077a0db84f22976c3cf464541
MD5 60369ae1b92f967ca4fda0319f4b78e7
SHA1 3c51c40e55f442d198c0bac842386bc17c355332
SHA512 74c463263fa8218e1c18b9710e181c8fa27edfe55209605547bdce787e3dd1abeda89e6ef222fc73ad64d27d3e0649069fdbb0dd87e58d51689f3d1b6dc72f21
SSDEEP 6144:kxPtJCIskd+MvmY6MAr+X+4kzxJyg7TJoKdJnZE:ytJCID+qmYur+X+4kzPb7TJoKJnZE
TLSH
T1F2746D1AFBA454B9E167C138C9678905E7B27C464B61E6CF13A40B5A2F33FE0893E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
Size 17.2MB
SHA256 846ad51298e1b9411bf604e7f721bef65462c37c5ecc91fdbcd6dec7593266f0
MD5 d8fac3bea5cb04bd3c29cc0a7ef638b1
SHA1 b2e5cf7f70d215db60a41f7a844de62dfe3c76ca
SHA512 70183cdb09f2633ae9b0cf176c5b8f4a64a07e9b6d9620b5b1c51794dec580bdc84edfddebc3997aaffc5efb14e94c1393b6f4820d0c7a7022f5dff65884598d
SSDEEP 98304:8r9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXk:Mffggz7Q35r36YriN707er
TLSH
T1CE078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librustdesk.dll

Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
Size 33.6MB
SHA256 1ca121afe29c248be5b3f3c4452203b972345cf526dd2acfcafdbb6544653f8d
MD5 f9b25648e1c019d2ea4c81ed5b939b3d
SHA1 b8701de28b90899ca0827a04966d85c46c902800
SHA512 f4795e5b50307439e4f0a85ff7c8cfb0511083ea1e4c743aa22cf75ef873c579bc0df68c9a50db9654d062a1ed3b2c67a71594758feb75e2c85102457b6708d6
SSDEEP 393216:jmGTYz8iDLyybt2ITxma5m0gmWme4urFfPLHx/9sgVztm/y1kWoh4DQaEjHSFD80:jmga8k0jgvs+Pskw
TLSH
T12C777B46F25651A8C02AE474826B6E23FBB13C4D43356BEB17D09A213E63BD05B3F785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printer_driver_adapter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
Size 1.3MB
SHA256 5aa5ab329b173f656bd4705bf1f6957b7660a28cbf0fb0ffeb07b56df813a79b
MD5 e6d88e26448138ae24995ebf0179cac9
SHA1 212486e72511bff729cf3ad7021ddc82ac5a4282
SHA512 9c8d6de617b3200940ca3828021e96bce8d2ad01a5df955bfbaa2071c796a1cb2b9d271fbb713236a48ce2364d1fc051ecd103829f8e3ffe5bc1b01144776d99
SSDEEP 12288:4p/Xcx9Pzjzg7xHQOJdbbUi62yg50h9XDM+q7TbtNDYWF/70jKvO2SnZu:4QPzYfJdPUi62ygU9jq7/YWejn2SnZu
TLSH
T1F0556D62BA55897DC05BC07082574BA6AE7134CA0B35A9FF41988A783F26FF51F3C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 354KB
SHA256 038d48a738929db68091c8f115e9472028f56b6632bdbd1115ae5416489c87a0
MD5 761f90c9b232aafd99bbd959d223ebb1
SHA1 fb955408aebbe36c66e9f6d24eaecbe6d5d9a8fa
SHA512 57e4c0657df6cb6c842b9b333dd712ac6c757435e46f40c9d1d6bae06949ff656e79a33146edfe5b9a5a48a613b42e595767c04ea7b8082f921420da76071435
SSDEEP 6144:1G5FpnOTl7CxJ83ItpaW8WNSWoWYWRWUWPWjWNWTW8uFM30PKGh1wlKfSj0EjW0e:Y8RCxJlaW8WNSWoWYWRWUWPWjWNWTWd3
TLSH
T12C747D1AFBA414F9E167C138CD564945EAB2BC5A0BA1D7CF13940B5A2F336E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
Size 524KB
SHA256 477e9f2c558d5f65dca4487918efc558d364858642f4d2bdad50feedf4cb10f3
MD5 b3c5fbbfbf47a8545eb094b67946fa64
SHA1 356b8f8950e2e5d3ee1d9602318e8a76ddc504ce
SHA512 76e03f8bb218ce08fd80c8ba2d122b81a25ee8f02f876ef1a022c728647c689b55d68a2d8ec1a57bb100c515c9aac51b52d2de2c11b6c2d2bd8460b5fb4a6ad5
SSDEEP 6144:Bj8dsC+g8bdZyJwOKBFTmPzfltO64hoZrnrplTOxM3WkX0Z2c6Hz7wc1f+8knZw:BTC+h8zt9F8SX0Z2Zz7wc1fbknZw
TLSH
T197B47C29E6AC43B5E167D178C9534606F7B1B84A5760A6CF43E00AAE2F677F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texture_rgba_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
Size 329KB
SHA256 9b1bd31efe1601854003bd871bd2ccc77c6b70391dd5b1615b59ffd2c930c980
MD5 1b8e42b268495187274d667b8dfdd373
SHA1 a093e2c6543076d28954acf3134cf3ed3923dc42
SHA512 16904ed89e650c86b36a76e5e2d13268f66f6caa5c3188040928207261322834870a5c7da7bd5182834647c72ad68bd305c467d29e64d2bae9bc465aa935c815
SSDEEP 6144:Hq8IlC8X6RTo+76dmijWL4/42a7VHhGN7PwfnZi:HqC8M7MqE/477VHhkWnZi
TLSH
T183745B19F7A514B9E167C17CC9A74946EBB2BC460BA0E6CF13A0065A3F33BE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uni_links_desktop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
Size 528KB
SHA256 20d58d005516551f00cf9eccbd3a6a5933f895c7f9f8303724c0254a2cb4dfa4
MD5 dff6c28cd30b8d640b2b8034e88c9da8
SHA1 234eba67a825c5c1ece0bd2ba4edc5378287a91b
SHA512 4b1d8c28ac880b1636ea44e91f454a135eb6ca69e36cb27f360acba0d5508daf40e340b1f7d8690afa352241709db398c721eda4af2d59574ca3f22abf77cc4d
SSDEEP 12288:jndMP6ZCpRVvuokGD6oJeo7qaEWtBHqnZS:jndS4CEpGuoko7qaEkBHqnZS
TLSH
T1ADB48E29E7AC43B5E167D178C9834906E7B1B84A5761A7CF43E046AA1F277F04A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
Size 333KB
SHA256 e1308ed0c39f444ce62609d9f7377290ff1ed557dafa0ec05a6d12ca1ed9ce0b
MD5 f6d2dd2612cc34b8f3ad459f11d05a46
SHA1 896cb6713f1fed364de5f55bbecb4af6da299dc1
SHA512 ec7f4141bab6730d5ecde131b42d6a90e2d7914554998f8e30529e3d4356f2a06eff4e63d0e6a58a8aafa72f7064bec4f420c353870b941f467a9933a8a6bb2b
SSDEEP 6144:r1+tJ7UUC44LodrYG5JKvOniqv7VYLb3qLGnZp:52J7UUCCkGevOiqv7VYLbUGnZp
TLSH
T194746C1AF7A554B9E167C13CC9674941EBB2BC464BA1D6CF1390065A3F33BE08A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
Size 554KB
SHA256 8ce1a1d7b1847f9d01122c74386e72bc50c01e58db320e2d0dd92029c4804ad5
MD5 249d978d95fa4f662477466524145ae6
SHA1 965816a463ac41b2f8806e8fc4437dcf227789dc
SHA512 472d89e2e2491aa7190e9e055c97ceaeae63167ddbc129c32542cdc13cf70cb1a27f1c37007851b35bb9690df9289db7d38db45f1d9e99552d8ab49f6264d7e1
SSDEEP 6144:Yz/4tvwUzC07ic9wxz6pvHy/tznHXgPpqlT5Ahw9GcLq4Px/BfxWVHks6aPqaEBl:ZbC02csz/K4Lq4Pxv9aPqaEBPTknZAF
TLSH
T17AC48E1AA7A843B5E167D138C9874506EBB1B8465761A7CF03E05AAB2F277F04B3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_size_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
Size 522KB
SHA256 e3566edf512ecf59064cc634c09d877705936b441aa7d89f58983c6a769f141f
MD5 9a3871b2c62bbbeff84802a3d5458d39
SHA1 35eaaa0301c212153b9423baf749d9ba7eef951b
SHA512 53d28af8ae4ecebf37c6358a722df643be00f917fd8b705f00325927117ecd03d58c1b03545af8a6bdcb28f4f7bf54e7da52129251f2fb36997b320876032236
SSDEEP 6144:jtWFwCTwvRyxp23aUOzbYoTx5YCdekaRdgDQrxO2T6UMYPqaqjcP/hOFnZC:jRCTWOYoX5P2T6UMYPqaqjcPZOFnZC
TLSH
T1B0B46C19F7A843B6E167D138C8534506FBB1B84A176196CF43E056BA2F277E04A3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2636-154-0x00000158AD8D0000-0x00000158AE561000-memory.dmp

Download

memory/2636-157-0x00000158AD8D0000-0x00000158AE561000-memory.dmp

Download

memory/2636-155-0x00000158AD8D0000-0x00000158AE561000-memory.dmp

Download

memory/2636-158-0x00000158AE570000-0x00000158AE571000-memory.dmp

Download

memory/2636-152-0x00000158AD3B0000-0x00000158AD3B1000-memory.dmp

Download