0d219c2b61a3e97b23623c3d8fd1676502995ec4a48365fc14a35a0c457ad323

Analysis

user interaction
yes
max time kernel
299s
max time network
289s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/09/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rustdesk-1.4.9-x86_64.zip
Size 33.7MB
Sample260929-v6evvssvbv
SHA256 0d219c2b61a3e97b23623c3d8fd1676502995ec4a48365fc14a35a0c457ad323
MD5 4c3f7b002bdb7346b8546eb13e23ad60
SHA1 7486d0ecaf1ce4a0dae18dfb6c2b2e003df13c64
SHA512 f27a3b178cd66ab8dfc5c6181067aeb404c029eba53e6dab8bbd59bedb9c349d0b734913a5b2db9c3eb13ce7da123384d17094ef90e321035164cab78045cd5e
SSDEEP 786432:V4wCNWnbLiLhzKk9mtw+B86LRmbQ7wbEyQQtSMNqcAuph:V4wCNWnbamkMJB86BNyQuNqcAuL
TLSH
T12F7733617CF25500B326713268A78D59718DBE92F44DEF620B002E74AE2F9CDEA7D64C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	rustdesk.exe

Executes dropped EXE 5 IoCs

pid	Process
4180	rustdesk-1.4.9-x86_64.exe
3064	rustdesk.exe
2240	rustdesk.exe
3124	rustdesk.exe
1040	rustdesk.exe

Loads dropped DLL 60 IoCs

pid	Process
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
3064	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
3064	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
3124	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe
1040	rustdesk.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\rustdesk_rCURRENT.log	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4256	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rustdesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rustdesk.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5800	taskkill.exe
3052	taskkill.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	rustdesk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f14040000000100000010000000d386d4056a495dd632c4c9c8be8574060f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf	rustdesk.exe
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692	rustdesk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692\Blob = 030000000100000014000000329b78a5c9ebc2043242de90ce1b7c6b1ba6c69214000000010000001400000032eb929aff3596482f284042702036915c1785e60400000001000000100000002aa320982e00193fad3bd0ea5406e4cd0f0000000100000030000000a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a41900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000730500003082056f30820457a003020102021048fc93b46055948d36a7c98a89d69416300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3231303532353030303030305a170d3238313233313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a38201123082010e301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070303301b0603551d200414301230060604551d20003008060667810c01040130430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010012bfa1ef8b749a9844b86946b5ab240a0ca48a67b83a81bf458a7d5207a88d1f4e218539a36b5e2d2086bf10b8ae793b53cdb4fbd844be06d95c6367d44016874486722ad63215f51283c2f9e15d114067f6422772c523e202381a4c20e2db01f7cd464f26a27c66c05136b6890254c7fc58fb6c00eefe98a62e95a10c53291f6fd819a64f9ef7ac09ea5d82c68baf80a7bd8148528431da32ec15e4a64c3d6c3973d40b853920e0851a68e1a74838a9d1362577c18d1916c5884c667d2f63ce98e869dfac3ca85d9dc91c5baed8f32f74cfb87ef6d7839d1196629aae4513da7fdc47fbdfc3529fe60655e99d8cf23a6251bcec240f29d4588084e4457b5ad8	rustdesk.exe
Key created	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70	rustdesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 0f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	rustdesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3064	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3064	rustdesk.exe
3064	rustdesk.exe
2240	rustdesk.exe
2240	rustdesk.exe
3140	setup.exe
3140	setup.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	taskkill.exe
Token: SeDebugPrivilege	2240	rustdesk.exe
Token: SeDebugPrivilege	3052	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	rustdesk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	rustdesk.exe
3064	rustdesk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4180	3140	setup.exe	95
PID 4180 wrote to memory of 5800	4180	rustdesk-1.4.9-x86_64.exe	96
PID 4180 wrote to memory of 3064	4180	rustdesk-1.4.9-x86_64.exe	99
PID 3064 wrote to memory of 2240	3064	rustdesk.exe	100
PID 3064 wrote to memory of 4256	3064	rustdesk.exe	101
PID 3064 wrote to memory of 3124	3064	rustdesk.exe	103
PID 4256 wrote to memory of 3052	4256	cmd.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.zip
1⤵
PID:5760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5836

C:\Users\Admin\Documents\rustdesk-1.4.9-x86_64\setup.exe
"C:\Users\Admin\Documents\rustdesk-1.4.9-x86_64\setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe
  C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Modifies system certificate store
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_3064_0505d6b2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2240
    - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
        
        "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_3064_0505d6b2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1040
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM RuntimeBroker_rustdesk.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rustdesk-1.4.9-x86_64.exe

Path C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe
Size 23.3MB
SHA256 eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274
MD5 3dcd83c485b9fbc53d7d56fb9d4585f0
SHA1 16510df7792f178932e964180d277ce0414d3f03
SHA512 54f5635928b61a09b8897664397965ea21d098c503fd88d4aac62a8bb30f012ce62e4405100322e3dd4533b68e16945b162f9784f873f2a7e8526503f89def68
SSDEEP 393216:tRjHllxmdlrzd1Wn6xOjAZ8WSI4AtJRA82xXphKiCwqFf4vIr5wFndQOqv4CDIV3:LjF+dxzd1Wn6bZfPtJRAVhKiVqFwvwSB
TLSH
T177373360F25515F9E51BC43092425AB2A73ABC754B107CFB11A871263F7AAF01F3B7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
Size 12.7MB
SHA256 a84705c3be6be7a580319a59cd7c57c9a96b0750884f6464200bfcc71ac11fda
MD5 a49df9135a8318f106a7fdf8a0fbdb6f
SHA1 75ae0cde1b77167087fb726dc448c1ab82332206
SHA512 6b36840f0149ed281a56cc43bb2c00fda7cb00c483132a3c489b3ce9d2daf89a84e70ce0ce4520b7049f8715a8a61277e0415f3564102d863dccca5cb44b9592
SSDEEP 393216:24P9xyn4VkiVydmJbmHUofbTxbHyMMMNa6e2Kh4xBpoa:ppVZZmTjTxjyANbe2Kupoa
TLSH
T16DD63B5FD0B943A0C025B6B5F79EAFB95E1878D85E70A18656DC0B623E97C600BCF072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
Size 330KB
SHA256 8390d51178a8a8b9b2ec978579f9196b6d5608a875a1ab95f215330381e88620
MD5 9a375f8ca9ed509ca001bedfa7f9e1d2
SHA1 cafa3f13a7eef1e12d763a5563c017475ed27186
SHA512 fe0c25d83c0c03469c125bd38c78b5931dbb16926ce586b311e92a9434c21cb522348070568717eff55a539d63a13ef7c5df56b13d4c8819e609fddb86c64290
SSDEEP 6144:JRd/9uC6PoqJivCriaariRxiKPl0Ryn7SGIU:JRaC6xi6DaGTiKPloy7SGIU
TLSH
T15B745B19B7A554BAE167C53CC9A34945EBF2BC560BA0DACB1390075A3F33BE0493E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_multi_window_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Size 394KB
SHA256 03335bb8c4c341fdaf4824a24ca8a7af3054c3afe159fadf7400cb72520fa6c0
MD5 a9aec194a16cdffa3a39962cc3d548c9
SHA1 c6cf9bf8d9c38b9fc13feb8332de458b0119095c
SHA512 16a07181cac7e4e7ccecaa462a017cca92cf5a4305ff92ce2a54633293fbf0d04cd7a07273bb33c086021b3671510d4cf09bb85f727c3cf50f7e921e9789e5b4
SSDEEP 6144:xEHBL7tynClpbXh3mkPBBN2IGdkemLEgxEPwltvXT0unMIK:G1iCl7FvN2DdCxEPwltvXouMIK
TLSH
T1B1846C2AFB6504B5E167C138C9B74646DA727C894B609BCF2394075A6F33FE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
Size 357KB
SHA256 585e7452e5ceedd5865215166ccad52df440f6561e8c6b961b1e32acb345462d
MD5 8fcf3e2fb05204632874777148eb54b3
SHA1 56ce73aa7d201e29db175f4fa6bb83814c6c9876
SHA512 71e8c77615a30cdb6bf73f59c4f2bde2abfbeeedff0f12ce8f1ce49d1a539588b41b44d2478dae83328eb2ff0a9113f45a49abb21401139534e7e4e776e9fdbb
SSDEEP 6144:HRDPe8/ArrCObbV7jMiW0zBOHpxI9z63dx7x/sTE7BI5c:xCrrCQVjW0UpChE7x/smBIi
TLSH
T1A9746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_custom_cursor_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
Size 320KB
SHA256 fff1deb1700232f53dc8e035df565a5bfb3b8f77d055303499fa120d387effd5
MD5 9c5cf51b659b0f42946f6c6627b41ddb
SHA1 5162d1ba09ff6062839e4262e8791c4ed66c86e8
SHA512 8c51aea6762e0815cc877e9c4638732a443dcc3a7a5b1219a44dbad177630766af6169c93883f1a489058ab0ed4de93a7c068d4b8c826613b5427b7baf592baf
SSDEEP 6144:iwYCGjdkOMK38qsYp+G9pF9Z7qaEWgaX7MIP:pYCGjnl3G03pfZ7qaEWgnIP
TLSH
T1D7646C19F7A454BAE167813CCD974945EBF278420BA4E6CB1390069A3F37BE14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_gpu_texture_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Size 352KB
SHA256 bc6b81e8dd2c26c55f354b8c194729314a5a3c5e89b00657d0f173fc40282641
MD5 98ddf6ff589c6365a704b16257821b46
SHA1 dc55da88203b237f50513106006610bb3a4f6c55
SHA512 9ed6805a1810c32dfbe7527e2dbf53f2645af2d7bb46b1f9f9c217d4129cec02f7cb940ed947624912e9792aa31b298f428f0c31a141dc0c217a47afb6eaeec1
SSDEEP 6144:ZIqQRCxIDdJ9kzqMeOtvQVSUiOASg7Tio+irIy:lQRCxyJ+zUOWVSUiOG7TiodIy
TLSH
T132747D1AFBA454B9E167C138C9674946E7B27C460B609BCF13A40B5A2F37FE0893E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
Size 17.2MB
SHA256 a5f97552c3b65ea2f3b661730cd1028518dac8f3c876e523bde6388460e004d0
MD5 742d50e9e119d8e169c0be2e0017efd1
SHA1 8500a21613f516864f3b953bd131287a10210aa0
SHA512 a97ed55e9e3d9be9e841200fd265248de9f5d189b34ce7148f04d06d3dbc4b37310b99b24a9cf9d59fdf805d2c4887fdebd3a9119b324e594b6e3ee7d3e99be2
SSDEEP 98304:dr9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXf:jffggz7Q35r36YriN707e4
TLSH
T15F078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librustdesk.dll

Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
Size 34.5MB
SHA256 e301faa89ff987bfde010ef286e9b90a9a251a77f1d843d71c370b58f3970f02
MD5 6701fbf8f57916c4c296fe1b0d20d659
SHA1 82a0f2fa6e2305aaa6aeedd8c5b0384c8d704d72
SHA512 decaf74e2966483e1d74e83902fbbcdc1287e0f8a9fdcea23700e58b48c8a2494c420d6ec7cc4b73bbce2970adaf7dbc889f17edf1d36155df578fec3dc7459b
SSDEEP 393216:NxQ6Scx7TkL7o2JEtKapfgOtUnoALOq+duy+QPFyED5CAHG4GPomYaowrHd2ZWzG:NG6DUAgyduuXPZ5
TLSH
T157877C46F36651A8C02AE474826B6E22FAB17C4D43316BEB17D44A213E63BD05B3F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printer_driver_adapter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
Size 1.3MB
SHA256 3b26e3e8fe82bca48241c16bb7b64c02a2b0d8b691bd1355cc5baa95cacd0162
MD5 4e6366996620135ffff0d54a42c6d7a2
SHA1 3429561bca2345f087dd413bb9768af9a2f3de06
SHA512 1d0a1701f9803c0cbca7bbc33c5be9adce7f9cf79c3f186f02a99d41c255ef17b9788b5677a1becb28eeb4bd25de5188233529c6fb4c3f111d8563d5bafa88f9
SSDEEP 24576:TUzwii98X0HkTYjW1JXp2gX9N8WdAov2Efq/FBIA:YzwLHOa4Xp2vWdfqdd
TLSH
T123557C62FA95897DC06BC07482574BB6AA7174CA0B30A9FF419896383E25FF51F3C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 358KB
SHA256 3ccd9d5e1f14d1013d12e79c8426a07cc057510fe6d6676309771f03db2bfbdd
MD5 67c6517649180470bd162656542a7c9c
SHA1 9fdf732da96a4a18888692ee2bb8756a78ece2ca
SHA512 be35db473044fdabac92e80ab8365d9768704a9498c95897f2700973a294059b77a85c6bd9248371c9a90a56a4cd334b813d03ec9f32a1f52d6b92cb235c2382
SSDEEP 6144:UebSY1I7C/UpanQo06Up3Qou01bvcFm0EjW0VqS2F4I/p:CC/DL0r3QCbUm0EjW0VqS+4Ih
TLSH
T1B3747E19FBA414F9E1678538CD664945EA727C4A0BB1D7CF23940B9A2F33AE04D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
Size 524KB
SHA256 1a697ecc0c7103985eafb47bb540d65dcde62722c8ef3de0b079843c15406c3b
MD5 7754c4a0dbbbf55384ec5518810ca5a5
SHA1 86b5e4b7bb6981fbe961844927ba9ec0cd44e992
SHA512 55f967348a86f5c09990e4a6e5ade7768ba66130894201f9083a8ee460621e2e6b0ae0ff89331f8c84b3e49950a9d5d54377611e815089b421b653c3fd7de628
SSDEEP 6144:QvM4CN74yApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82Aroz7wzfhPbVIL:QpCNkTAizXjjT3+LDfaoz7wzfpbVIL
TLSH
T1E9B46C2AE7A843B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texture_rgba_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
Size 329KB
SHA256 86422ea280c8e7832580e09c9b621ea47728c9c69e12482f2227661f19831ef4
MD5 77d5cb0ae6c909785f5e09e0e0eecee8
SHA1 a6a34bc6954c7ccc8c9412f183d37e9ff97e5a49
SHA512 99fbdd2c73cfcf240249159556b1356e05774b21ae15c15628ca8201b952c62ce720b6c0a8f6b77728ba4740457ef15e698c950c2ed4dc0af3747d354cfe303a
SSDEEP 6144:8K6gpCyvo6xlody6G1iYpCyb7Vuhu4nqaIIW:8YCyghybroyb7VuhhIIW
TLSH
T155745B1AF7A514B5E167853CC9A34A46EBF27C460BA1DACF13A0065A3F33BE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uni_links_desktop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
Size 527KB
SHA256 e3d82b056d29a083106319d620015afc2ffe1750d0ec31e5b3562806b978da56
MD5 01069a3aeff67ff7f82bcfaefc326750
SHA1 4a86c97e62085ac509bb01b404227d7267ad3eb4
SHA512 cb4c9ca2a5690f80b1d4cf443d96e4a7b1f7e4b89f3f897dfeb29078ededc4aa7a6dd402b4b01cfb4963df5c9616ae9ee850fcdfa699e49248f7b305735ca5d9
SSDEEP 6144:QT8UknWtCV/HZFfulbfzHlvnCN3WZlAgNSAWUSXYFs+F1EkMdNVQ7qaEXhYLhcFa:QT8NMCV8lvnljhF1EkMdfQ7qaEXhjFIx
TLSH
T116B47D29F7AC43B5E167D178C9534906E7B1B84A5761A7CF43E006AA2F277E04A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
Size 333KB
SHA256 e5753d4fdc8c07c2012c2abd201a1c509aaaa64a4d0908745bcd4ac990a4763b
MD5 47e9fa036c379c610aaf6debe63c9a22
SHA1 a2a7322cf2adde904afcb960b880ed2a49aa1081
SHA512 bbc96487c9244cb184cf3eaca521e5dcdc60db498a04e2bc0e5ae556f503f4ba024da21cd289b5cf4d71fa4903acc2db171824232bbd1740e467d8999c4c27af
SSDEEP 6144:T7uWnIdCDOlYgxWprJc0XuM5J7VAbzhIe:mWnIdChgUpO0+M5J7VAb9Ie
TLSH
T1BB746B1AF7A554B9E167C13CC9634945EBB2BC524BA0D6CF1390065A3F37BE08A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
Size 553KB
SHA256 7a4a074cd90de3f65ee6a9fa9db7fc21417dfa1959c154f5aa0d4cdd0259e728
MD5 f2f0085dce96c2042048468169ebdc3d
SHA1 4b2c444735c4d9f05721ba05d1e6a2b714e41cb3
SHA512 0f2a11c8e48a3e1f81215e0302f11ff8bea3ce7a5e907cb7d280d1458fa66bc5f09d7416dcbb508aac8fb18fd46a36f71874aacb1dfaca4b8cbf2c56b5957680
SSDEEP 6144:zhljoCpiGgCP3CB0+rx9GhawM/3zuc37gvOJwzZ/4t1GdjS2QMEUcOzdCR7l+0Pf:FgCPyBdz1Z8jpQTc0PqaEOLT9IwJ
TLSH
T13FC48D1AB6A843B5E167D138C9874606EBB1B8465761A7CF03E056AF2F277F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_size_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
Size 522KB
SHA256 084613f3450272ffa4d9932f234fcfad690fee8385655fdb8c41b1956cd23bc5
MD5 dee76b243848ca7eb1e08951a5eb53a5
SHA1 73f8871635c7f108f44e72cbdcc12988b3aa3b0e
SHA512 ae8e3938a8a559da45750950b277478997d4e8ed88b1cd75ae7139a2a0586d25495fa401b4cd83793a5f801d9b1bd51c1ce3842fe09c2223a77063bdfc22f80c
SSDEEP 6144:/thj2BCUMPI7HV0nUBD5P9noC+yCIz3JjjoI1ZiQfKxY8CAj8PqaqAPG3XeeMI7:/CCUPNnoIF13KxY8Z8PqaqAPtI7
TLSH
T16BB46D29E7AC43B6F167D178C9574502EBB1784A176197CF03E046BA2F277E04A3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustDesk2.toml

Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk2.toml
Size 126B
SHA256 6826f83f6602aadddcbc1d38d93308cffe848422b120ae7f35f784f6061e5cd6
MD5 311b84438e969d1574d0d208b7d81612
SHA1 1335ad2a59067154632f22d72bdc03093c204bc8
SHA512 5fd61b877d337018b90be88704ddc8d1bf868154ce24258ea270bba49e922bcbab7ecba1b84443dfd0c84c897f4decf5ec387d479a662d4862a5004c329fd239
TLSH
T1ADB02B40C6B3328020D500C40C3B1024CC2C8732194A05D03383C20060CC509DB08D17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-336-0x00000223A1530000-0x00000223A3825000-memory.dmp

Download

memory/1040-248-0x00000223A1530000-0x00000223A3825000-memory.dmp

Download

memory/2240-232-0x0000019D04370000-0x0000019D06665000-memory.dmp

Download

memory/3064-183-0x0000023614FD0000-0x0000023614FD1000-memory.dmp

Download

memory/3064-425-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-184-0x0000023615840000-0x00000236164F9000-memory.dmp

Download

memory/3064-235-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-852-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-185-0x0000023615840000-0x00000236164F9000-memory.dmp

Download

memory/3064-251-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-262-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-272-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-310-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-186-0x0000023615840000-0x00000236164F9000-memory.dmp

Download

memory/3064-348-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-387-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-187-0x000002360FC80000-0x000002360FC81000-memory.dmp

Download

memory/3064-463-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-502-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-540-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-575-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-611-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-651-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-691-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-731-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-769-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3064-810-0x0000023609850000-0x000002360BB45000-memory.dmp

Download

memory/3124-238-0x0000012A4E210000-0x0000012A50505000-memory.dmp

Download