eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rustdesk-1.4.9-x86_64.exe
Size 23.3MB
Sample260930-vjaydsshlf
SHA256 eaedeb0088e687bf46f7c46a9c6ea5493ce51f3134dfd6acbedb47b5b9136274
MD5 3dcd83c485b9fbc53d7d56fb9d4585f0
SHA1 16510df7792f178932e964180d277ce0414d3f03
SHA512 54f5635928b61a09b8897664397965ea21d098c503fd88d4aac62a8bb30f012ce62e4405100322e3dd4533b68e16945b162f9784f873f2a7e8526503f89def68
SSDEEP 393216:tRjHllxmdlrzd1Wn6xOjAZ8WSI4AtJRA82xXphKiCwqFf4vIr5wFndQOqv4CDIV3:LjF+dxzd1Wn6bZfPtJRAVhKiVqFwvwSB
TLSH
T177373360F25515F9E51BC43092425AB2A73ABC754B107CFB11A871263F7AAF01F3B7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion discovery execution rat spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	rustdesk.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5104	rustdesk.exe

Executes dropped EXE 5 IoCs

pid	Process
5104	rustdesk.exe
4700	rustdesk.exe
4212	rustdesk.exe
408	rustdesk.exe
5128	rustdesk.exe

Loads dropped DLL 64 IoCs

pid	Process
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
4700	rustdesk.exe
5104	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
4212	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
408	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe

RustDesk remote access tool
RustDesk is an open-source remote admin tool.
backdoor rat

Discovers running processes 1 TTPs 57 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6376	tasklist.exe
7088	tasklist.exe
5736	tasklist.exe
6048	tasklist.exe
4392	tasklist.exe
5536	tasklist.exe
5980	tasklist.exe
5884	tasklist.exe
5892	tasklist.exe
6264	tasklist.exe
6620	tasklist.exe
6400	tasklist.exe
6080	tasklist.exe
6352	tasklist.exe
4108	tasklist.exe
5880	tasklist.exe
4908	tasklist.exe
6504	tasklist.exe
6112	tasklist.exe
2264	tasklist.exe
756	tasklist.exe
5164	tasklist.exe
6176	tasklist.exe
6636	tasklist.exe
6192	tasklist.exe
5764	tasklist.exe
6136	tasklist.exe
1160	tasklist.exe
5852	tasklist.exe
6080	tasklist.exe
5336	tasklist.exe
6420	tasklist.exe
992	tasklist.exe
5696	tasklist.exe
888	tasklist.exe
5352	tasklist.exe
5580	tasklist.exe
5088	tasklist.exe
5624	tasklist.exe
5872	tasklist.exe
5464	tasklist.exe
5352	tasklist.exe
6112	tasklist.exe
7036	tasklist.exe
1536	tasklist.exe
5360	tasklist.exe
1200	tasklist.exe
6780	tasklist.exe
1388	tasklist.exe
5088	tasklist.exe
4960	tasklist.exe
6740	tasklist.exe
6924	tasklist.exe
6136	tasklist.exe
5876	tasklist.exe
5708	tasklist.exe
7060	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\log\portable-service\rustdesk_rCURRENT.log	rustdesk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 58 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5532	cmd.exe
5600	cmd.exe
5952	cmd.exe
5348	cmd.exe
4224	cmd.exe
1536	cmd.exe
5472	cmd.exe
4908	cmd.exe
6068	cmd.exe
5804	cmd.exe
3160	cmd.exe
2392	cmd.exe
6412	cmd.exe
6572	cmd.exe
7144	cmd.exe
4100	cmd.exe
5732	cmd.exe
6216	cmd.exe
6700	cmd.exe
5716	cmd.exe
6000	cmd.exe
5936	cmd.exe
5564	cmd.exe
5344	cmd.exe
5844	cmd.exe
6692	cmd.exe
6864	cmd.exe
6664	cmd.exe
6064	cmd.exe
448	cmd.exe
3508	cmd.exe
6084	cmd.exe
6464	cmd.exe
6536	cmd.exe
4996	cmd.exe
5520	cmd.exe
6920	cmd.exe
5832	cmd.exe
1612	cmd.exe
6484	cmd.exe
6580	cmd.exe
6932	cmd.exe
4324	cmd.exe
5628	cmd.exe
5616	cmd.exe
5772	cmd.exe
7012	cmd.exe
7128	cmd.exe
4596	cmd.exe
5972	cmd.exe
5012	cmd.exe
6492	cmd.exe
5688	cmd.exe
5768	cmd.exe
1412	cmd.exe
5336	cmd.exe
6328	cmd.exe
6340	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rustdesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rustdesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rustdesk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rustdesk.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3976	taskkill.exe
4668	taskkill.exe

Modifies system certificate store 2 TTPs 10 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	rustdesk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70\Blob = 0300000001000000140000000185ff9961ff0aa2e431817948c28e83d3f3ec70140000000100000014000000813292412b28cd46c8c4a2c62a3912ec48a93f14040000000100000010000000d386d4056a495dd632c4c9c8be8574060f0000000100000030000000f55821c081b58e86eaa202923e715e1524c422c7be0469b13a9e7a319e50d70cb5b67e864273029a79250f9dc3203cbd19000000010000001000000079d9deaeb2dbf0e37e8750aa80b4cdfa5c0000000100000004000000000c00001800000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c4b0000000100000044000000310038004500360042003400410035003700410036004200430037004500430039004200380036003100430044004600320044003600440030004400300032005f0000002000000001000000200600003082061c30820404a003020102021033d708a891405319e2a5bbd339b9ad6e300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3336303332313233353935395a3057310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312e302c060355040313255365637469676f205075626c696320436f6465205369676e696e6720434120455620523336308201a2300d06092a864886f70d01010105000382018f003082018a0282018100bbd1fe1eb7425b78f590a7ae2c83f18d21d33086857bdfd3cdd9164bac85c5bb01cfe28c28117204762c81c5ab127a404ac510e88114391b5f4f07f63030307f3525e5c0733d400994e8a8f8eb390b55d5b60c8b1e27f8de3e22c1bfef65ee73ee65dd28ddbb1f7d9b327fb7995517aab249a83c106a3ac321b299a843d73b82a81961b53e6a5a5db8bc9e13d00a9ef55b8f693868eaa51f5bca23ee0bedbcd01e43436eb0538cc2732a44316ebe8fb8c602f6bb820415790c5220e898277161ef2fe4f802fb3359b5f4c355e7dff60822aeb6d10959ec019f7389b7434fd5f2d9bd565909ddb717f6c47480ba8746ac06dbdb040dd54ebaee8c093419951be670130425df8fb8d784338c6ca60ceb68ba954f7c44e8d4698d2579c321f13577f84fb6125595d056e81802d5ee79c886a169f11b4e94136a0762f0d06b99a597509e1c33a11eee618b05681c8ef5ee269083d6fe7185a79af20d143e36b512ad77757acce746366a9053cbc69471de073a21f9d63267e09c6e5486a064a083cb0203010001a38201633082015f301f0603551d2304183016801432eb929aff3596482f284042702036915c1785e6301d0603551d0e04160414813292412b28cd46c8c4a2c62a3912ec48a93f14300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff02010030130603551d25040c300a06082b06010505070303301a0603551d200413301130060604551d20003007060567810c0103304b0603551d1f044430423040a03ea03c863a687474703a2f2f63726c2e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e63726c307b06082b06010505070101046f306d304606082b06010505073002863a687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f5075626c6963436f64655369676e696e67526f6f745234362e703763302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d300d06092a864886f70d01010c050003820201005f36acfbf9f6725a14b7f00b1dded8fd9701d2fd01ee992d86e8f6b7f039ffd6814a5aa7424a0a2d159de694fdc5694ab2d74bf116124cf6be9066658b2d74d4ab08f76a110308777cbe69e1b0db9f248903d6de5ca4e0b2d6b4cfe338d5b96dcc27d6ce6411e8107276d3f9e0e92c89e949d3b39796060ae1f60ac8419a915d81d8367798ca804197a8f8913f639faacd54544b80eaf51766d39471fd9efd4731e3e91a861dd3be20d23fb1525fb293bd8c950998728f9501f49843a54afb1426aa9d36bf72b0fcdcbd840deced34a85e952b3816630575d9f6312e156be294b22ad27435b5989aa3fef82b2fb6174b276c5ae6b9765eda86ddab64d66aea8318881b3182f588b39425c0212f086902e34cbb4c2a1130eb817906e141952ad420f60b93e47c760c9d1d266b5f8401f62a99cdafdec7f0e418a24e9b2f2a0c66a6927526bed94035136faea6371a7ae8ad1c5163072a56066ced7e18f6e3ec6473a66d08368baf0f99ae756b172bc24d6ac351464156e98fc28dff13719bdaed9ed39fabe545a612c5145a524197a3060008c5e61cea27823c3bdbe646c4ef2d003513cd367d9de5aa270805cccec0360e4b194fd0639a6dbfc529533122db75507786d0f2f86aee6b061b3e85232b97c87e7a99410cdd587f0ea8c3123d3a359be09d2c8c17815444a87a1d989d967f5958a65465ff51420bf847ebcff8e5bf	rustdesk.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692\Blob = 030000000100000014000000329b78a5c9ebc2043242de90ce1b7c6b1ba6c69214000000010000001400000032eb929aff3596482f284042702036915c1785e60400000001000000100000002aa320982e00193fad3bd0ea5406e4cd0f0000000100000030000000a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a41900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000730500003082056f30820457a003020102021048fc93b46055948d36a7c98a89d69416300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3231303532353030303030305a170d3238313233313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a38201123082010e301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070303301b0603551d200414301230060604551d20003008060667810c01040130430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010012bfa1ef8b749a9844b86946b5ab240a0ca48a67b83a81bf458a7d5207a88d1f4e218539a36b5e2d2086bf10b8ae793b53cdb4fbd844be06d95c6367d44016874486722ad63215f51283c2f9e15d114067f6422772c523e202381a4c20e2db01f7cd464f26a27c66c05136b6890254c7fc58fb6c00eefe98a62e95a10c53291f6fd819a64f9ef7ac09ea5d82c68baf80a7bd8148528431da32ec15e4a64c3d6c3973d40b853920e0851a68e1a74838a9d1362577c18d1916c5884c667d2f63ce98e869dfac3ca85d9dc91c5baed8f32f74cfb87ef6d7839d1196629aae4513da7fdc47fbdfc3529fe60655e99d8cf23a6251bcec240f29d4588084e4457b5ad8	rustdesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 0f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be0b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000006200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a3814000000010000001400000032eb929aff3596482f284042702036915c1785e61d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f609000000010000000c000000300a06082b06010505070303030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	rustdesk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	rustdesk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D\Blob = 1900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c030000000100000014000000ccbbf9e1485af63ce47abf8e9e648c2504fc319d09000000010000000c000000300a06082b060105050703031d0000000100000010000000b57b5c441b8ef4866b6f8f43ff6e45f614000000010000001400000032eb929aff3596482f284042702036915c1785e66200000001000000200000007e76260ae69a55d3f060b0fd18b2a8c01443c87b60791030c9fa0b0585101a380b000000010000004a0000005300650063007400690067006f0020005000750062006c0069006300200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400360000000f000000010000003000000009cc9211dbd405f0eb21b2fe598b2439893f4c3d478888adf01431a8b1fb66bd524266fc4e875f022623e69fcb4dd9be20000000010000007c0500003082057830820360a00302010202104b2c3b01018bad2abc8c7b5b3eed9057300d06092a864886f70d01010c05003056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a3423040301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201007665c2e3d7224ad71d895eff695ec614024d73a6cdcd28cab037eabfa7c921aaaa5fdabff6836cd080d10a5c00a4cbf3cc390f9e417188d53ce88a7b8c1723f7ca3474916c06ae503f0059b2263c3c178357033e2dd11a3dd4cf0754b2430b5272a888f5c417f26fd158a5d168e43d980818ee36f448489afa5470f088d47016304249d0d93f754b4571d8aea2bb610e88855057b9ba112b36291f8f20729e5c9e89d182da458d6a99da84716b33a510bb79f097f67481a03f57c7868c308c0e3895ae01c61eabdca81f6f2fd7ff761eae17736de5b975b36106a89533c24e6fb237f295be855412b9c8bd624276f72afcf53731032657fed1e6dbf0160272838c08b384aca9e407f8a188c4135a50475442a6edd041342c98b13ea234a10c5dbdacf77f79a7bf6d0c5632851b4b97b8e1ace4a43c71f1a3e14e63d6f446baf50b08e1633ceda2592f0ad42c6b23a29ea14deed112cd183350ed416ecb7f3d41600b630b78f575ef4315b7360b10afdc5c18a998d936d91dd884b3068a82e37b1b24a742ceee0f3e565c327dec4bde562b3b3bbaf97a58d051b66cd6f658a252247a4486a11c603f49d3fcfaf9841c05c234bfe2e6f1192a992f5657359cb5f507c3462fde383d190dfba3f1df139ee7a9725831afbdeadad7d66d7733338ef4acfdc1bf4987d27005677406a6f678402d1604910f1fd316c4b87a170d24c9b2	rustdesk.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0185FF9961FF0AA2E431817948C28E83D3F3EC70	rustdesk.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5104	rustdesk.exe
5128	rustdesk.exe
5104	rustdesk.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4700	rustdesk.exe
4700	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe
5104	rustdesk.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	4700	rustdesk.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	5580	tasklist.exe
Token: SeDebugPrivilege	5736	tasklist.exe
Token: SeDebugPrivilege	5852	tasklist.exe
Token: SeDebugPrivilege	5980	tasklist.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	5464	tasklist.exe
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	5880	tasklist.exe
Token: SeDebugPrivilege	6048	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	5352	tasklist.exe
Token: SeDebugPrivilege	5764	tasklist.exe
Token: SeDebugPrivilege	5872	tasklist.exe
Token: SeDebugPrivilege	4908	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	5360	tasklist.exe
Token: SeDebugPrivilege	4392	tasklist.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	5536	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	5876	tasklist.exe
Token: SeDebugPrivilege	5696	tasklist.exe
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	888	tasklist.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeDebugPrivilege	5352	tasklist.exe
Token: SeDebugPrivilege	756	tasklist.exe
Token: SeDebugPrivilege	5708	tasklist.exe
Token: SeDebugPrivilege	5164	tasklist.exe
Token: SeDebugPrivilege	5892	tasklist.exe
Token: SeDebugPrivilege	5336	tasklist.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	6264	tasklist.exe
Token: SeDebugPrivilege	6376	tasklist.exe
Token: SeDebugPrivilege	6504	tasklist.exe
Token: SeDebugPrivilege	6620	tasklist.exe
Token: SeDebugPrivilege	6740	tasklist.exe
Token: SeDebugPrivilege	6924	tasklist.exe
Token: SeDebugPrivilege	7060	tasklist.exe
Token: SeDebugPrivilege	6176	tasklist.exe
Token: SeDebugPrivilege	6420	tasklist.exe
Token: SeDebugPrivilege	6636	tasklist.exe
Token: SeDebugPrivilege	6780	tasklist.exe
Token: SeDebugPrivilege	1388	tasklist.exe
Token: SeDebugPrivilege	5088	tasklist.exe
Token: SeDebugPrivilege	1160	tasklist.exe
Token: SeDebugPrivilege	7088	tasklist.exe
Token: SeDebugPrivilege	6192	tasklist.exe
Token: SeDebugPrivilege	6400	tasklist.exe
Token: SeDebugPrivilege	6352	tasklist.exe
Token: SeDebugPrivilege	992	tasklist.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	5088	tasklist.exe
Token: SeDebugPrivilege	4960	tasklist.exe
Token: SeDebugPrivilege	7036	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5104	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5104	rustdesk.exe
5104	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe
5128	rustdesk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3976	4684	rustdesk-1.4.9-x86_64.exe	86
PID 4684 wrote to memory of 5104	4684	rustdesk-1.4.9-x86_64.exe	89
PID 5104 wrote to memory of 4700	5104	rustdesk.exe	96
PID 5104 wrote to memory of 4100	5104	rustdesk.exe	97
PID 5104 wrote to memory of 4212	5104	rustdesk.exe	98
PID 4100 wrote to memory of 4668	4100	cmd.exe	102
PID 5104 wrote to memory of 5128	5104	rustdesk.exe	116
PID 5104 wrote to memory of 5532	5104	rustdesk.exe	118
PID 5532 wrote to memory of 5580	5532	cmd.exe	120
PID 5532 wrote to memory of 5588	5532	cmd.exe	121
PID 5104 wrote to memory of 5688	5104	rustdesk.exe	122
PID 5688 wrote to memory of 5736	5688	cmd.exe	124
PID 5688 wrote to memory of 5744	5688	cmd.exe	125
PID 5104 wrote to memory of 5804	5104	rustdesk.exe	126
PID 5804 wrote to memory of 5852	5804	cmd.exe	128
PID 5804 wrote to memory of 5860	5804	cmd.exe	129
PID 5104 wrote to memory of 5936	5104	rustdesk.exe	130
PID 5936 wrote to memory of 5980	5936	cmd.exe	132
PID 5936 wrote to memory of 5988	5936	cmd.exe	133
PID 5104 wrote to memory of 6064	5104	rustdesk.exe	134
PID 6064 wrote to memory of 6112	6064	cmd.exe	136
PID 6064 wrote to memory of 6120	6064	cmd.exe	137
PID 5104 wrote to memory of 4324	5104	rustdesk.exe	138
PID 4324 wrote to memory of 5464	4324	cmd.exe	140
PID 4324 wrote to memory of 5520	4324	cmd.exe	141
PID 5104 wrote to memory of 5600	5104	rustdesk.exe	142
PID 5600 wrote to memory of 5624	5600	cmd.exe	144
PID 5600 wrote to memory of 5704	5600	cmd.exe	145
PID 5104 wrote to memory of 5732	5104	rustdesk.exe	146
PID 5732 wrote to memory of 5880	5732	cmd.exe	148
PID 5732 wrote to memory of 5888	5732	cmd.exe	149
PID 5104 wrote to memory of 5832	5104	rustdesk.exe	150
PID 5832 wrote to memory of 6048	5832	cmd.exe	152
PID 5832 wrote to memory of 1928	5832	cmd.exe	153
PID 5104 wrote to memory of 6000	5104	rustdesk.exe	154
PID 6000 wrote to memory of 6080	6000	cmd.exe	156
PID 6000 wrote to memory of 5180	6000	cmd.exe	157
PID 5104 wrote to memory of 6068	5104	rustdesk.exe	158
PID 6068 wrote to memory of 5352	6068	cmd.exe	160
PID 6068 wrote to memory of 5612	6068	cmd.exe	161
PID 5104 wrote to memory of 5348	5104	rustdesk.exe	162
PID 5348 wrote to memory of 5764	5348	cmd.exe	164
PID 5348 wrote to memory of 5572	5348	cmd.exe	165
PID 5104 wrote to memory of 5564	5104	rustdesk.exe	166
PID 5564 wrote to memory of 5872	5564	cmd.exe	168
PID 5564 wrote to memory of 5892	5564	cmd.exe	169
PID 5104 wrote to memory of 3160	5104	rustdesk.exe	170
PID 3160 wrote to memory of 4908	3160	cmd.exe	172
PID 3160 wrote to memory of 4268	3160	cmd.exe	173
PID 5104 wrote to memory of 448	5104	rustdesk.exe	174
PID 448 wrote to memory of 6080	448	cmd.exe	176
PID 448 wrote to memory of 5180	448	cmd.exe	177
PID 5104 wrote to memory of 5520	5104	rustdesk.exe	178
PID 5520 wrote to memory of 5360	5520	cmd.exe	180
PID 5520 wrote to memory of 5344	5520	cmd.exe	181
PID 5104 wrote to memory of 5768	5104	rustdesk.exe	182
PID 5768 wrote to memory of 4392	5768	cmd.exe	184
PID 5768 wrote to memory of 1100	5768	cmd.exe	185
PID 5104 wrote to memory of 5972	5104	rustdesk.exe	188
PID 5972 wrote to memory of 6136	5972	cmd.exe	190
PID 5972 wrote to memory of 5968	5972	cmd.exe	191
PID 5104 wrote to memory of 5344	5104	rustdesk.exe	192
PID 5344 wrote to memory of 5536	5344	cmd.exe	194
PID 5344 wrote to memory of 3088	5344	cmd.exe	195

C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe
"C:\Users\Admin\AppData\Local\Temp\rustdesk-1.4.9-x86_64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM RuntimeBroker_rustdesk.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
  "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service --portable-service-shmem-name=_portable_service_5104_811dcc65
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
  - - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
      "C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system --portable-service-shmem-name=_portable_service_5104_811dcc65
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      PID:408
- - C:\Windows\system32\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4212
- - C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
    "C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --cm
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5128
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5580
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5588
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5736
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5744
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5852
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5860
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5980
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5988
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6112
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5464
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5520
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5624
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5704
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5880
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5888
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6048
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:1928
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6080
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5352
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5612
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5764
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5872
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5892
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4908
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6080
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5360
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5344
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:1100
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6136
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5968
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5536
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3508
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5884
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6028
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5876
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5872
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5696
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5556
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2264
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5884
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6136
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:888
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5856
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1536
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5560
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5352
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:888
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:756
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5852
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5708
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:2376
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5164
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5556
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5892
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6116
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5336
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5892
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6112
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:2376
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:5932
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6264
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6272
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6376
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6384
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6504
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6512
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6620
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6628
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6740
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6748
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6924
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6932
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:7012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:7060
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:7068
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:7128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6176
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6168
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6420
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6476
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6636
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6656
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6780
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6744
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1388
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:204
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5088
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6840
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1160
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6980
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:7088
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:7144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6192
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:7132
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6400
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6304
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:6352
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:1380
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:992
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:3532
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6664
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4108
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:1540
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5088
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6840
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4960
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:6964
- - C:\Windows\system32\cmd.exe
    "cmd" /C "tasklist | findstr consent.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:7036
  - - C:\Windows\system32\findstr.exe
      findstr consent.exe
      4⤵
      PID:7048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.so

Path C:\Users\Admin\AppData\Local\rustdesk\data\app.so
Size 12.7MB
SHA256 a84705c3be6be7a580319a59cd7c57c9a96b0750884f6464200bfcc71ac11fda
MD5 a49df9135a8318f106a7fdf8a0fbdb6f
SHA1 75ae0cde1b77167087fb726dc448c1ab82332206
SHA512 6b36840f0149ed281a56cc43bb2c00fda7cb00c483132a3c489b3ce9d2daf89a84e70ce0ce4520b7049f8715a8a61277e0415f3564102d863dccca5cb44b9592
SSDEEP 393216:24P9xyn4VkiVydmJbmHUofbTxbHyMMMNa6e2Kh4xBpoa:ppVZZmTjTxjyANbe2Kupoa
TLSH
T16DD63B5FD0B943A0C025B6B5F79EAFB95E1878D85E70A18656DC0B623E97C600BCF072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\rustdesk\data\flutter_assets\FontManifest.json
Size 483B
SHA256 068f1cc96816fab157a6813ce233731e46bf661ad84d0018381fb58b19396886
MD5 f4f31d18ca443c7bfb50340e84b860d5
SHA1 f97538077e02122cf0377211bba8a4ab0bbbe4f3
SHA512 3da40b86ad28f41e29b44112601a910e4d2def19a0da8de3c272fb59227b025f7d25e713a3f89d22069f5799bf68fa4ac5647e85a71344925d664a61ac3e6ffe
TLSH
T1DDF0540F052519F890DDC595B0E3649370542B47528DE81EE7751FA4ABF0B0027286F3
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\rustdesk\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_drop_plugin.dll
Size 330KB
SHA256 8390d51178a8a8b9b2ec978579f9196b6d5608a875a1ab95f215330381e88620
MD5 9a375f8ca9ed509ca001bedfa7f9e1d2
SHA1 cafa3f13a7eef1e12d763a5563c017475ed27186
SHA512 fe0c25d83c0c03469c125bd38c78b5931dbb16926ce586b311e92a9434c21cb522348070568717eff55a539d63a13ef7c5df56b13d4c8819e609fddb86c64290
SSDEEP 6144:JRd/9uC6PoqJivCriaariRxiKPl0Ryn7SGIU:JRaC6xi6DaGTiKPloy7SGIU
TLSH
T15B745B19B7A554BAE167C53CC9A34945EBF2BC560BA0DACB1390075A3F33BE0493E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_multi_window_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
Size 394KB
SHA256 03335bb8c4c341fdaf4824a24ca8a7af3054c3afe159fadf7400cb72520fa6c0
MD5 a9aec194a16cdffa3a39962cc3d548c9
SHA1 c6cf9bf8d9c38b9fc13feb8332de458b0119095c
SHA512 16a07181cac7e4e7ccecaa462a017cca92cf5a4305ff92ce2a54633293fbf0d04cd7a07273bb33c086021b3671510d4cf09bb85f727c3cf50f7e921e9789e5b4
SSDEEP 6144:xEHBL7tynClpbXh3mkPBBN2IGdkemLEgxEPwltvXT0unMIK:G1iCl7FvN2DdCxEPwltvXouMIK
TLSH
T1B1846C2AFB6504B5E167C138C9B74646DA727C894B609BCF2394075A6F33FE04A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\file_selector_windows_plugin.dll
Size 357KB
SHA256 585e7452e5ceedd5865215166ccad52df440f6561e8c6b961b1e32acb345462d
MD5 8fcf3e2fb05204632874777148eb54b3
SHA1 56ce73aa7d201e29db175f4fa6bb83814c6c9876
SHA512 71e8c77615a30cdb6bf73f59c4f2bde2abfbeeedff0f12ce8f1ce49d1a539588b41b44d2478dae83328eb2ff0a9113f45a49abb21401139534e7e4e776e9fdbb
SSDEEP 6144:HRDPe8/ArrCObbV7jMiW0zBOHpxI9z63dx7x/sTE7BI5c:xCrrCQVjW0UpChE7x/smBIi
TLSH
T1A9746D1AFBA854B5E167C178CDA78945EBB27C460B6096CF23A0075A2F33FE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_custom_cursor_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
Size 320KB
SHA256 fff1deb1700232f53dc8e035df565a5bfb3b8f77d055303499fa120d387effd5
MD5 9c5cf51b659b0f42946f6c6627b41ddb
SHA1 5162d1ba09ff6062839e4262e8791c4ed66c86e8
SHA512 8c51aea6762e0815cc877e9c4638732a443dcc3a7a5b1219a44dbad177630766af6169c93883f1a489058ab0ed4de93a7c068d4b8c826613b5427b7baf592baf
SSDEEP 6144:iwYCGjdkOMK38qsYp+G9pF9Z7qaEWgaX7MIP:pYCGjnl3G03pfZ7qaEWgnIP
TLSH
T1D7646C19F7A454BAE167813CCD974945EBF278420BA4E6CB1390069A3F37BE14A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_gpu_texture_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
Size 352KB
SHA256 bc6b81e8dd2c26c55f354b8c194729314a5a3c5e89b00657d0f173fc40282641
MD5 98ddf6ff589c6365a704b16257821b46
SHA1 dc55da88203b237f50513106006610bb3a4f6c55
SHA512 9ed6805a1810c32dfbe7527e2dbf53f2645af2d7bb46b1f9f9c217d4129cec02f7cb940ed947624912e9792aa31b298f428f0c31a141dc0c217a47afb6eaeec1
SSDEEP 6144:ZIqQRCxIDdJ9kzqMeOtvQVSUiOASg7Tio+irIy:lQRCxyJ+zUOWVSUiOG7TiodIy
TLSH
T132747D1AFBA454B9E167C138C9674946E7B27C460B609BCF13A40B5A2F37FE0893E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\rustdesk\flutter_windows.dll
Size 17.2MB
SHA256 a5f97552c3b65ea2f3b661730cd1028518dac8f3c876e523bde6388460e004d0
MD5 742d50e9e119d8e169c0be2e0017efd1
SHA1 8500a21613f516864f3b953bd131287a10210aa0
SHA512 a97ed55e9e3d9be9e841200fd265248de9f5d189b34ce7148f04d06d3dbc4b37310b99b24a9cf9d59fdf805d2c4887fdebd3a9119b324e594b6e3ee7d3e99be2
SSDEEP 98304:dr9tjMEbhsb464T36lgzqbka78FKAWS3rpUJkUNZ3phDJ8cpSq6nYriNtZ356rXf:jffggz7Q35r36YriN707e4
TLSH
T15F078C03E59640FDC48DD2B89B5B9A27F671B8490621B5DF238827263F67BB01B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librustdesk.dll

Path C:\Users\Admin\AppData\Local\rustdesk\librustdesk.dll
Size 34.5MB
SHA256 e301faa89ff987bfde010ef286e9b90a9a251a77f1d843d71c370b58f3970f02
MD5 6701fbf8f57916c4c296fe1b0d20d659
SHA1 82a0f2fa6e2305aaa6aeedd8c5b0384c8d704d72
SHA512 decaf74e2966483e1d74e83902fbbcdc1287e0f8a9fdcea23700e58b48c8a2494c420d6ec7cc4b73bbce2970adaf7dbc889f17edf1d36155df578fec3dc7459b
SSDEEP 393216:NxQ6Scx7TkL7o2JEtKapfgOtUnoALOq+duy+QPFyED5CAHG4GPomYaowrHd2ZWzG:NG6DUAgyduuXPZ5
TLSH
T157877C46F36651A8C02AE474826B6E22FAB17C4D43316BEB17D44A213E63BD05B3F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printer_driver_adapter.dll

Path C:\Users\Admin\AppData\Local\rustdesk\printer_driver_adapter.dll
Size 1.3MB
SHA256 3b26e3e8fe82bca48241c16bb7b64c02a2b0d8b691bd1355cc5baa95cacd0162
MD5 4e6366996620135ffff0d54a42c6d7a2
SHA1 3429561bca2345f087dd413bb9768af9a2f3de06
SHA512 1d0a1701f9803c0cbca7bbc33c5be9adce7f9cf79c3f186f02a99d41c255ef17b9788b5677a1becb28eeb4bd25de5188233529c6fb4c3f111d8563d5bafa88f9
SSDEEP 24576:TUzwii98X0HkTYjW1JXp2gX9N8WdAov2Efq/FBIA:YzwLHOa4Xp2vWdfqdd
TLSH
T123557C62FA95897DC06BC07482574BB6AA7174CA0B30A9FF419896383E25FF51F3C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rustdesk.exe

Path C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe
Size 358KB
SHA256 3ccd9d5e1f14d1013d12e79c8426a07cc057510fe6d6676309771f03db2bfbdd
MD5 67c6517649180470bd162656542a7c9c
SHA1 9fdf732da96a4a18888692ee2bb8756a78ece2ca
SHA512 be35db473044fdabac92e80ab8365d9768704a9498c95897f2700973a294059b77a85c6bd9248371c9a90a56a4cd334b813d03ec9f32a1f52d6b92cb235c2382
SSDEEP 6144:UebSY1I7C/UpanQo06Up3Qou01bvcFm0EjW0VqS2F4I/p:CC/DL0r3QCbUm0EjW0VqS+4Ih
TLSH
T1B3747E19FBA414F9E1678538CD664945EA727C4A0BB1D7CF23940B9A2F33AE04D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\screen_retriever_plugin.dll
Size 524KB
SHA256 1a697ecc0c7103985eafb47bb540d65dcde62722c8ef3de0b079843c15406c3b
MD5 7754c4a0dbbbf55384ec5518810ca5a5
SHA1 86b5e4b7bb6981fbe961844927ba9ec0cd44e992
SHA512 55f967348a86f5c09990e4a6e5ade7768ba66130894201f9083a8ee460621e2e6b0ae0ff89331f8c84b3e49950a9d5d54377611e815089b421b653c3fd7de628
SSDEEP 6144:QvM4CN74yApJ245VAhLQzzBzXjEUmo1wOerpzQSUJ+LDf82Aroz7wzfhPbVIL:QpCNkTAizXjjT3+LDfaoz7wzfpbVIL
TLSH
T1E9B46C2AE7A843B5E167D138C9534606F7B1B84A576196CF43E00AAE2F677F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texture_rgba_renderer_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
Size 329KB
SHA256 86422ea280c8e7832580e09c9b621ea47728c9c69e12482f2227661f19831ef4
MD5 77d5cb0ae6c909785f5e09e0e0eecee8
SHA1 a6a34bc6954c7ccc8c9412f183d37e9ff97e5a49
SHA512 99fbdd2c73cfcf240249159556b1356e05774b21ae15c15628ca8201b952c62ce720b6c0a8f6b77728ba4740457ef15e698c950c2ed4dc0af3747d354cfe303a
SSDEEP 6144:8K6gpCyvo6xlody6G1iYpCyb7Vuhu4nqaIIW:8YCyghybroyb7VuhhIIW
TLSH
T155745B1AF7A514B5E167853CC9A34A46EBF27C460BA1DACF13A0065A3F33BE0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uni_links_desktop_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
Size 527KB
SHA256 e3d82b056d29a083106319d620015afc2ffe1750d0ec31e5b3562806b978da56
MD5 01069a3aeff67ff7f82bcfaefc326750
SHA1 4a86c97e62085ac509bb01b404227d7267ad3eb4
SHA512 cb4c9ca2a5690f80b1d4cf443d96e4a7b1f7e4b89f3f897dfeb29078ededc4aa7a6dd402b4b01cfb4963df5c9616ae9ee850fcdfa699e49248f7b305735ca5d9
SSDEEP 6144:QT8UknWtCV/HZFfulbfzHlvnCN3WZlAgNSAWUSXYFs+F1EkMdNVQ7qaEXhYLhcFa:QT8NMCV8lvnljhF1EkMdfQ7qaEXhjFIx
TLSH
T116B47D29F7AC43B5E167D178C9534906E7B1B84A5761A7CF43E006AA2F277E04A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
Size 333KB
SHA256 e5753d4fdc8c07c2012c2abd201a1c509aaaa64a4d0908745bcd4ac990a4763b
MD5 47e9fa036c379c610aaf6debe63c9a22
SHA1 a2a7322cf2adde904afcb960b880ed2a49aa1081
SHA512 bbc96487c9244cb184cf3eaca521e5dcdc60db498a04e2bc0e5ae556f503f4ba024da21cd289b5cf4d71fa4903acc2db171824232bbd1740e467d8999c4c27af
SSDEEP 6144:T7uWnIdCDOlYgxWprJc0XuM5J7VAbzhIe:mWnIdChgUpO0+M5J7VAb9Ie
TLSH
T1BB746B1AF7A554B9E167C13CC9634945EBB2BC524BA0D6CF1390065A3F37BE08A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_manager_plugin.dll
Size 553KB
SHA256 7a4a074cd90de3f65ee6a9fa9db7fc21417dfa1959c154f5aa0d4cdd0259e728
MD5 f2f0085dce96c2042048468169ebdc3d
SHA1 4b2c444735c4d9f05721ba05d1e6a2b714e41cb3
SHA512 0f2a11c8e48a3e1f81215e0302f11ff8bea3ce7a5e907cb7d280d1458fa66bc5f09d7416dcbb508aac8fb18fd46a36f71874aacb1dfaca4b8cbf2c56b5957680
SSDEEP 6144:zhljoCpiGgCP3CB0+rx9GhawM/3zuc37gvOJwzZ/4t1GdjS2QMEUcOzdCR7l+0Pf:FgCPyBdz1Z8jpQTc0PqaEOLT9IwJ
TLSH
T13FC48D1AB6A843B5E167D138C9874606EBB1B8465761A7CF03E056AF2F277F04A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_size_plugin.dll

Path C:\Users\Admin\AppData\Local\rustdesk\window_size_plugin.dll
Size 522KB
SHA256 084613f3450272ffa4d9932f234fcfad690fee8385655fdb8c41b1956cd23bc5
MD5 dee76b243848ca7eb1e08951a5eb53a5
SHA1 73f8871635c7f108f44e72cbdcc12988b3aa3b0e
SHA512 ae8e3938a8a559da45750950b277478997d4e8ed88b1cd75ae7139a2a0586d25495fa401b4cd83793a5f801d9b1bd51c1ce3842fe09c2223a77063bdfc22f80c
SSDEEP 6144:/thj2BCUMPI7HV0nUBD5P9noC+yCIz3JjjoI1ZiQfKxY8CAj8PqaqAPG3XeeMI7:/CCUPNnoIF13KxY8Z8PqaqAPtI7
TLSH
T16BB46D29E7AC43B6F167D178C9574502EBB1784A176197CF03E046BA2F277E04A3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustDesk2.toml

Path C:\Users\Admin\AppData\Roaming\RustDesk\config\RustDesk2.toml
Size 124B
SHA256 942eb92efd8bd97220d2ab41107797acb5e362842500d12cd7308f4690289caa
MD5 f76384d17699a422a42cef56e03a5fb7
SHA1 357d6eac2f0c28a46037bd0241f108177da4d95d
SHA512 fef0c74b83d45b17ddddde202e4e2e1b197b51ff113700cea42441c59a5b096c77084ee2633425c454b4af671df13c56a086f732806355de8980a2278e903c71
TLSH
T125B02280CAB3328020C800C02C3B2028CC2C83322A8A0AE03383C202A0CCA0ACA08E2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5104-165-0x0000022AA7300000-0x0000022AA7301000-memory.dmp

Download

memory/5104-161-0x0000022AA72F0000-0x0000022AA72F1000-memory.dmp

Download

memory/5104-162-0x0000022AA77A0000-0x0000022AA8459000-memory.dmp

Download

memory/5104-164-0x0000022AA77A0000-0x0000022AA8459000-memory.dmp

Download

memory/5104-163-0x0000022AA77A0000-0x0000022AA8459000-memory.dmp

Download