Windows Analysis Report
rustdesk-1.2.2-x86_64.exe

Overview

General Information

Sample Name: rustdesk-1.2.2-x86_64.exe
Analysis ID: 1315930
MD5: f78e62330c6757d845aa9b348f33e784
SHA1: 8d42a07fa3f1fd0d2345a5d97a91847e5fc9f663
SHA256: 7d8790e65a906706a93734b91efa6dfdb732f9897e04707233fe48033bd5654e
Infos:

Detection

BazaLoader
Score: 45
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 32
Range: 0 - 100

Signatures

Yara detected BazaLoader
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Queries the volume information (name, serial number etc) of a device
Drops certificate files (DER)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Abnormal high CPU Usage
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Installs a raw input device (often for capturing keystrokes)
DLL planting / hijacking vulnerabilities found
Sample file is different than original file name gathered from version info
Drops PE files
Tries to load missing DLLs
Uses cacls to modify the permissions of files
Detected TCP or UDP traffic on non-standard ports
Binary contains a suspicious time stamp
Uses taskkill to terminate processes
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
BazarBackdoor, bazaloader BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).For now, it exclusively uses Emercoin domains (.bazar), thus the naming. FireEye uses KEGTAP as name for BazarLoader and BEERBOT for BazarBackdoor.
  • UNC1878
 https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: rustdesk-1.2.2-x86_64.exe Virustotal: Detection: 7% Perma Link
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe EXE: icacls.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: C:\Users\user\AppData\Local\rustdesk\RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: taskkill.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe EXE: cmd.exe Jump to behavior
DLL planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\flutter_windows.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SAS.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WINMM.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\desktop_drop_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WTSAPI32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: bcrypt.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: Secur32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dxva2.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\url_launcher_windows_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dwmapi.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CRYPTSP.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\uni_links_desktop_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d11.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: UIAutomationCore.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: TextInputFramework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WINMMBASE.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\window_size_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\window_manager_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SAMCLI.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: pdh.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: PROPSYS.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: GLU32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SSPICLI.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: userenv.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: amfrt64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CRYPTBASE.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CoreUIComponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: OPENGL32.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\desktop_multi_window_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: IPHLPAPI.DLL
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\screen_retriever_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: netapi32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d11_1sdklayers.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d9.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\librustdesk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dxgi.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: NETUTILS.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: OLEACC.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CoreMessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WindowsCodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\WindowInjection.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CLDAPI.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver\RustDeskIddDriver.dll Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe EXE: icacls.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: C:\Users\user\AppData\Local\rustdesk\RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe EXE: taskkill.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe EXE: cmd.exe Jump to behavior
DLL planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\flutter_windows.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SAS.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WINMM.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\desktop_drop_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WTSAPI32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: bcrypt.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: Secur32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dxva2.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\url_launcher_windows_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dwmapi.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CRYPTSP.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\uni_links_desktop_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d11.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: UIAutomationCore.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: TextInputFramework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WINMMBASE.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\window_size_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\window_manager_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SAMCLI.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: pdh.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: PROPSYS.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: GLU32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: SSPICLI.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: userenv.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: amfrt64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CRYPTBASE.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CoreUIComponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: OPENGL32.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\desktop_multi_window_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: IPHLPAPI.DLL
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\screen_retriever_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: netapi32.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d11_1sdklayers.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: d3d9.dll
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\librustdesk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: dxgi.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: NETUTILS.DLL
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: OLEACC.dll
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CoreMessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: WindowsCodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\WindowInjection.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe DLL: CLDAPI.dll Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe DLL: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver\RustDeskIddDriver.dll Jump to behavior
Source: rustdesk-1.2.2-x86_64.exe Static PE information: certificate valid
Source: rustdesk-1.2.2-x86_64.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\b\s\w\ir\cache\builder\src\out\host_release\flutter_windows.dll.pdb source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621066498.000001924BD37000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E73E000.00000002.00000001.01000000.0000000F.sdmp
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6F32C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose, 8_2_00007FF70EF6F32C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCA4F4 FindFirstFileExW, 8_2_00007FF811DCA4F4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E59198 FindFirstFileExW, 8_2_00007FF811E59198
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming\RustDesk Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming\RustDesk\log Jump to behavior
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49785 -> 155.138.247.159:21116
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1085
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1452
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1452expandIntegerPowExpressionsThe
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1512
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1637
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/1936
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2046
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2152
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2152skipVSConstantRegisterZeroIn
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2162
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2273
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2517
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2894
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2970
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/2978
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3027
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3045
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3078
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3205
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3206
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3246
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3246allowClearForRobustResourceInitSome
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3452
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3498
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3502
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3577
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3584
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3586
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3623
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3624
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3625
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3682
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3682allowES3OnFL100Allow
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3729
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3832
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3862
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3965
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3970
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/3997
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4214
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4267
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4324
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4384
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4405
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4428
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4551
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4633
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4646
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4722
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/482
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4836
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4901
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/4937
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5007
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5007disableDrawBuffersIndexedDisable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5055
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5061
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5281
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5371
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5375
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5421
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5430
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5469
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5535
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5577
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5658
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5658forceGlErrorCheckingForce
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5750
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5750forceRobustResourceInitForce-enable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5881
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5901
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/5906
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6041
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6041forceInitShaderVariablesForce-enable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6048
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6141
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6248
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6439
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6651
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6692
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6755
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6860
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6876
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6878
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6929
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/6953
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7036
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7036~
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7047
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7172
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7279
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7279cacheCompiledShaderEnable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7370
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7406
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7488
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7527
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7553
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7556
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7724
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://anglebug.com/7724disableAnisotropicFilteringDisable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://canonicalizer.ucsuri.tcs/680074007400700073003a002f002f00700069006e0067002e002e00630068006500
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://canonicalizer.ucsuri.tcs/680074007400700073003a002f002f00700069006e0067002e002e006e0061007600
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1094869
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/110263
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1144207
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1165751
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1165751disableProgramBinaryDisable
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1171371
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1181068
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/1181193
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/308366
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/403957
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/550292
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/565179
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/642227
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/642605
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/644669
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/650547
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/672380
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/709351
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/797243
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/809422
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/830046
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/849576
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/883276
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/927470
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/941620
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://crbug.com/941620allowTranslateUniformBlockToStructuredBufferThere
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: rustdesk.exe, 00000003.00000003.627830086.000001D3A6960000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6C03000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6C03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRo
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6C03000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: rustdesk.exe, 00000003.00000003.670630316.000001D3B1E5B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.microso
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://issuetracker.google.com/200067929
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcodeRegularVersion
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6C03000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: http://www.w3c.orghttp://dev.w3.org/CSS/fonts/ahem/COPYING
Source: rustdesk.exe, 00000003.00000003.653870397.000001D3AFC4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://admin.rustdesk.com
Source: rustdesk.exe, 00000003.00000003.709893475.000001D3AFC4E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://admin.rustdesk.come
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://admin.rustdesk.comrustdesk.com/api/audit/
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://admin.rustdesk.comrustdesk.com/api/audit/P
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/4674
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/4849
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/5140
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/5536
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/5845
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7161
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7162
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7246
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7246enableCaptureLimitsSet
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7308
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7319
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7320
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7369
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7382
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7405
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7489
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7604
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7714
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://anglebug.com/7899
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=107106
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://chromium.googlesource.com/angle/angle/
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1042393
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1046462
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1060012
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1091824
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1137851
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/1300575
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/593024
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/593024selectViewInGeometryShaderThe
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/650547
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/650547callClearTwiceUsing
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/655534
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/655534useSystemMemoryForConstantBuffersCopying
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/705865
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/710443
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/811661
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://crbug.com/848952
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://docs.rs/flexi_logger/latest/flexi_logger/error_info/index.html#
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-supportCalling
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://github.com/dart-lang/sdk/blob/master/runtime/docs/compiler/aot/entry_point_pragma.md
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://github.com/flutter/flutter/issues.
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://github.com/flutter/flutter/issues.Invalid
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://github.com/rustdesk/rustdesk/wiki/Headless-Linux-SupportDesktop
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://github.com/rustdesk/rustdesk/wiki/Headless-Linux-Supportenc_idkey_pairkey_confirmedkeys_conf
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/161903006
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/166809097
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/184850002
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/187425444
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/220069903
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/220069903emulatePixelLocalStorageEmulate
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/229267970
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/250706693
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/253522366
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924C7CA000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp, rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/de/manual/mac/#berechtigungen-aktivierenHilfeFehlgeschlagenJemand
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/linux/#login-screenWayland
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/linux/#x11-required
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/linux/#x11-required0Z
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/linux/#x11-requiredrustdesk
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/mac/#enable-permissionsAjudaHa
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/manual/mac/PagalbaNepavykoPavykoKa
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/en/rustdesk
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/fr/manual/mac/#enable-permissionsAider
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/hu/manual/mac/#enable-permissionsSeg
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/ru/manual/mac/#
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/zh-cn/manual/mac#%E5%90%AF%E7%94%A8%E6%9D%83%E9%99%90
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CDE9000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://rustdesk.com/docs/zh-tw/manual/mac/#
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.619780956.0000019247ACD000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620326496.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621365067.0000019249A57000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp String found in binary or memory: https://streams.videolan.org/upload/
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B32000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: unknown DNS traffic detected: queries for: rs-ny.rustdesk.com
Creates a DirectInput object (often for capturing keystrokes)
Source: rustdesk.exe, 00000003.00000003.627830086.000001D3A6941000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/> memstr_7f929884-7
Installs a raw input device (often for capturing keystrokes)
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80D35A000.00000002.00000001.01000000.00000011.sdmp Binary or memory string: RegisterRawInputDevices memstr_f4e55f6d-2
Drops certificate files (DER)
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver\rustdeskidddriver.cat Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver.cer Jump to dropped file
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk
Detected potential crypto function
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF53D10 8_2_00007FF70EF53D10
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF67848 8_2_00007FF70EF67848
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF707A4 8_2_00007FF70EF707A4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6E5F4 8_2_00007FF70EF6E5F4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF73480 8_2_00007FF70EF73480
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF614A4 8_2_00007FF70EF614A4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF634AC 8_2_00007FF70EF634AC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6F32C 8_2_00007FF70EF6F32C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF71BF8 8_2_00007FF70EF71BF8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6C2AC 8_2_00007FF70EF6C2AC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF619FC 8_2_00007FF70EF619FC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF66A00 8_2_00007FF70EF66A00
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6BA00 8_2_00007FF70EF6BA00
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC62D8 8_2_00007FF811CC62D8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C8F290 8_2_00007FF811C8F290
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C9B238 8_2_00007FF811C9B238
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB518C 8_2_00007FF811CB518C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CCB128 8_2_00007FF811CCB128
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB74D0 8_2_00007FF811CB74D0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C984D4 8_2_00007FF811C984D4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C914C0 8_2_00007FF811C914C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CBD478 8_2_00007FF811CBD478
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA93DC 8_2_00007FF811CA93DC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA5384 8_2_00007FF811CA5384
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C903A8 8_2_00007FF811C903A8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA730C 8_2_00007FF811CA730C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC5300 8_2_00007FF811CC5300
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C8D2F8 8_2_00007FF811C8D2F8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB3328 8_2_00007FF811CB3328
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C95320 8_2_00007FF811C95320
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB5698 8_2_00007FF811CB5698
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C925DC 8_2_00007FF811C925DC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA253C 8_2_00007FF811CA253C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C968C0 8_2_00007FF811C968C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C9A8E0 8_2_00007FF811C9A8E0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC886C 8_2_00007FF811CC886C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C8D79C 8_2_00007FF811C8D79C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB275C 8_2_00007FF811CB275C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA6A58 8_2_00007FF811CA6A58
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C99A1C 8_2_00007FF811C99A1C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB79EC 8_2_00007FF811CB79EC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA19E0 8_2_00007FF811CA19E0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C759E0 8_2_00007FF811C759E0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC198C 8_2_00007FF811CC198C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB3958 8_2_00007FF811CB3958
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C98904 8_2_00007FF811C98904
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C85CE8 8_2_00007FF811C85CE8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C84C50 8_2_00007FF811C84C50
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CBBBD0 8_2_00007FF811CBBBD0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C83BC4 8_2_00007FF811C83BC4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C89BD8 8_2_00007FF811C89BD8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CBEEBC 8_2_00007FF811CBEEBC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA4E94 8_2_00007FF811CA4E94
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC0E54 8_2_00007FF811CC0E54
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C94DD0 8_2_00007FF811C94DD0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C78DC0 8_2_00007FF811C78DC0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA0D88 8_2_00007FF811CA0D88
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC2D3C 8_2_00007FF811CC2D3C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CA7D64 8_2_00007FF811CA7D64
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C98D34 8_2_00007FF811C98D34
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C9DD18 8_2_00007FF811C9DD18
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C810E0 8_2_00007FF811C810E0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C9C07C 8_2_00007FF811C9C07C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C89F3C 8_2_00007FF811C89F3C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D5BA6C 8_2_00007FF811D5BA6C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D54900 8_2_00007FF811D54900
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D233B8 8_2_00007FF811D233B8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D57B48 8_2_00007FF811D57B48
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D54620 8_2_00007FF811D54620
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D6159C 8_2_00007FF811D6159C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D118C0 8_2_00007FF811D118C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D4C058 8_2_00007FF811D4C058
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D5F008 8_2_00007FF811D5F008
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D3F788 8_2_00007FF811D3F788
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCA2E8 8_2_00007FF811DCA2E8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DBB210 8_2_00007FF811DBB210
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DA79C0 8_2_00007FF811DA79C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCA4F4 8_2_00007FF811DCA4F4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DBACA4 8_2_00007FF811DBACA4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC6C58 8_2_00007FF811DC6C58
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DB9C68 8_2_00007FF811DB9C68
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCD410 8_2_00007FF811DCD410
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC0BD4 8_2_00007FF811DC0BD4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DBD36C 8_2_00007FF811DBD36C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC26C0 8_2_00007FF811DC26C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DBCE60 8_2_00007FF811DBCE60
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCE5BC 8_2_00007FF811DCE5BC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DA9D50 8_2_00007FF811DA9D50
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC3524 8_2_00007FF811DC3524
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC48D4 8_2_00007FF811DC48D4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCC070 8_2_00007FF811DCC070
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DC77D0 8_2_00007FF811DC77D0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E562D8 8_2_00007FF811E562D8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E59198 8_2_00007FF811E59198
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E45190 8_2_00007FF811E45190
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E2C17C 8_2_00007FF811E2C17C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E5B128 8_2_00007FF811E5B128
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E394DC 8_2_00007FF811E394DC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E5C4C8 8_2_00007FF811E5C4C8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E474D0 8_2_00007FF811E474D0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E204A8 8_2_00007FF811E204A8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4D478 8_2_00007FF811E4D478
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E35484 8_2_00007FF811E35484
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E25420 8_2_00007FF811E25420
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E1D3F8 8_2_00007FF811E1D3F8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E1F390 8_2_00007FF811E1F390
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E2B338 8_2_00007FF811E2B338
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4332C 8_2_00007FF811E4332C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E55300 8_2_00007FF811E55300
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E226DC 8_2_00007FF811E226DC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4569C 8_2_00007FF811E4569C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E5D674 8_2_00007FF811E5D674
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E3263C 8_2_00007FF811E3263C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E285D4 8_2_00007FF811E285D4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E215C0 8_2_00007FF811E215C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E1D89C 8_2_00007FF811E1D89C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E1A8A5 8_2_00007FF811E1A8A5
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E5886C 8_2_00007FF811E5886C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E42760 8_2_00007FF811E42760
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E31AE0 8_2_00007FF811E31AE0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E28A04 8_2_00007FF811E28A04
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E479EC 8_2_00007FF811E479EC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E2A9E0 8_2_00007FF811E2A9E0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E269C0 8_2_00007FF811E269C0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E5198C 8_2_00007FF811E5198C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4395C 8_2_00007FF811E4395C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E09930 8_2_00007FF811E09930
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E16936 8_2_00007FF811E16936
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E19CD8 8_2_00007FF811E19CD8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E13CC4 8_2_00007FF811E13CC4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4BBD0 8_2_00007FF811E4BBD0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E05BB0 8_2_00007FF811E05BB0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E29B5A 8_2_00007FF811E29B5A
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E36B58 8_2_00007FF811E36B58
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E50ECC 8_2_00007FF811E50ECC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E24ED0 8_2_00007FF811E24ED0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E4EE9C 8_2_00007FF811E4EE9C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E30E88 8_2_00007FF811E30E88
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E37E64 8_2_00007FF811E37E64
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E28E34 8_2_00007FF811E28E34
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E2DE18 8_2_00007FF811E2DE18
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E15DE8 8_2_00007FF811E15DE8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E14D50 8_2_00007FF811E14D50
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E52D3C 8_2_00007FF811E52D3C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E1A03C 8_2_00007FF811E1A03C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E58F8C 8_2_00007FF811E58F8C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E34F94 8_2_00007FF811E34F94
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EBC2F0 8_2_00007FF811EBC2F0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EEA2EC 8_2_00007FF811EEA2EC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EB82D0 8_2_00007FF811EB82D0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811ED52C8 8_2_00007FF811ED52C8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EA8246 8_2_00007FF811EA8246
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EAF1AC 8_2_00007FF811EAF1AC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EBB46A 8_2_00007FF811EBB46A
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EC8468 8_2_00007FF811EC8468
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EE3414 8_2_00007FF811EE3414
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811EC33F0 8_2_00007FF811EC33F0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811ED935A 8_2_00007FF811ED935A
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process Stats: CPU usage > 49%
Sample file is different than original file name gathered from version info
Source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.620042662.0000019249751000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameflutter_hbb.exe8 vs rustdesk-1.2.2-x86_64.exe
Tries to load missing DLLs
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: amfrt64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: amfrt64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: nvcuda.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: d3d11_1sdklayers.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: d3d11_1sdklayers.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Section loaded: libmfxsw64.dll Jump to behavior
Source: rustdesk-1.2.2-x86_64.exe Virustotal: Detection: 7%
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM RuntimeBroker_rustdesk.exe
Source: C:\Windows\System32\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
Source: C:\Windows\System32\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
Source: C:\Windows\System32\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\rustdesk.exe" --portable-service
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\cmd.exe cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\rustdesk.exe" --run-as-system
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM RuntimeBroker_rustdesk.exe
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\rustdesk.exe" --portable-service Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\cmd.exe cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM RuntimeBroker_rustdesk.exe
Source: rustdesk.exe, 00000008.00000002.632590910.00007FF80CF40000.00000002.00000001.01000000.00000011.sdmp Memory string: rustls::msgs::handshake
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;RuntimeBroker_rustdesk.exe&quot;)
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;RuntimeBroker_rustdesk.exe&quot;)
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;RuntimeBroker_rustdesk.exe&quot;)
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File created: C:\Users\user\AppData\Local\Temp\shared_memory-rs Jump to behavior
Source: classification engine Classification label: mal45.troj.evad.winEXE@22/346@455/2
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF54F50 LoadCursorW,GetModuleHandleW,LoadIconW,RegisterClassW,MonitorFromPoint,FlutterDesktopGetDpiForMonitor,GetModuleHandleW,CreateWindowExW,CoCreateInstance, 8_2_00007FF70EF54F50
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_01
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: rustdesk-1.2.2-x86_64.exe Static file information: File size 20102832 > 1048576
Source: rustdesk-1.2.2-x86_64.exe Static PE information: certificate valid
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x12baa00
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: rustdesk-1.2.2-x86_64.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: rustdesk-1.2.2-x86_64.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\b\s\w\ir\cache\builder\src\out\host_release\flutter_windows.dll.pdb source: rustdesk-1.2.2-x86_64.exe, 00000000.00000003.622338253.000001924CD47000.00000004.00000020.00020000.00000000.sdmp, rustdesk-1.2.2-x86_64.exe, 00000000.00000003.621066498.000001924BD37000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000008.00000002.633594357.00007FF80E73E000.00000002.00000001.01000000.0000000F.sdmp
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rustdesk-1.2.2-x86_64.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811C8B607 push 8B48FFFFh; ret 8_2_00007FF811C8B60C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D08727 push rdx; ret 8_2_00007FF811D0872B
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DBFCFA push rdx; ret 8_2_00007FF811DBFCFB
PE file contains sections with non-standard names
Source: rustdesk-1.2.2-x86_64.exe Static PE information: section name: _RDATA
Source: uni_links_desktop_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: url_launcher_windows_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: window_manager_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: window_size_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: desktop_drop_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: desktop_multi_window_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: dylib_virtual_display.dll.0.dr Static PE information: section name: _RDATA
Source: flutter_custom_cursor_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: flutter_windows.dll.0.dr Static PE information: section name: _RDATA
Source: librustdesk.dll.0.dr Static PE information: section name: .rodata
Source: librustdesk.dll.0.dr Static PE information: section name: _RDATA
Source: rustdesk.exe.0.dr Static PE information: section name: _RDATA
Source: screen_retriever_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: texture_rgba_renderer_plugin.dll.0.dr Static PE information: section name: _RDATA
Source: RustDeskIddDriver.dll.0.dr Static PE information: section name: _RDATA
Source: RuntimeBroker_rustdesk.exe.0.dr Static PE information: section name: .imrsiv
Source: RuntimeBroker_rustdesk.exe.0.dr Static PE information: section name: .didat
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF53D10 LoadLibraryA,GetProcAddress,GetProcAddress,FindWindowW,DispatchToUniLinksDesktop,ShowWindow,SetForegroundWindow,AttachConsole,IsDebuggerPresent,CoInitializeEx,GetMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CoUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 8_2_00007FF70EF53D10
Binary contains a suspicious time stamp
Source: RuntimeBroker_rustdesk.exe.0.dr Static PE information: 0x96E0391B [Sat Mar 19 04:31:23 2050 UTC]
Drops PE files
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\desktop_multi_window_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\flutter_windows.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\desktop_drop_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\screen_retriever_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\RuntimeBroker_rustdesk.exe Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\librustdesk.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\url_launcher_windows_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\window_size_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\WindowInjection.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\uni_links_desktop_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver\RustDeskIddDriver.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe File created: C:\Users\user\AppData\Local\rustdesk\window_manager_plugin.dll Jump to dropped file
Uses cacls to modify the permissions of files
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe System information queried: FirmwareTableInformation Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe TID: 7332 Thread sleep time: -900000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\rustdesk\WindowInjection.dll Jump to dropped file
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver\RustDeskIddDriver.dll Jump to dropped file
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Window / User API: threadDelayed 490 Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Window / User API: threadDelayed 637 Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Window / User API: threadDelayed 653 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe API coverage: 3.9 %
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6F32C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose, 8_2_00007FF70EF6F32C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DCA4F4 FindFirstFileExW, 8_2_00007FF811DCA4F4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E59198 FindFirstFileExW, 8_2_00007FF811E59198
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming\RustDesk Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe File opened: C:\Users\user\AppData\Roaming\RustDesk\log Jump to behavior
Source: rustdesk.exe, 00000003.00000003.649646413.000001D3AF749000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Virtual Machine Bus Provider PipesX
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: VMware
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: GL_EXT_texture_lod_biasARB_draw_buffersGL_EXT_texture_swizzleGL_ARB_shader_bit_encodingGL_ARB_shading_language_packingGL_ARB_explicit_attrib_locationGL_ARB_explicit_uniform_locationGL_ARB_texture_gatherGL_ARB_texture_cube_map_arrayGL_EXT_draw_buffers2GL_ARB_fragment_shaderGL_ARB_shader_texture_lodGL_ARB_shader_viewport_layer_arrayGL_NV_viewport_array2GL_ARB_robust_buffer_access_behaviorGL_ARB_gpu_shader5GL_ARB_cull_distancefunctions->standard == STANDARD_GL_DESKTOP && isAMDfunctions->standard == STANDARD_GL_DESKTOP && isIntelisIntel && !IsSandyBridge(device) && !IsIvyBridge(device) && !IsHaswell(device)!isMesa || isIntel && (Is9thGenIntel(device) || IsGeminiLake(device) || IsCoffeeLake(device) || Is11thGenIntel(device) || Is12thGenIntel(device))IsApple() && isIntelisIntel && IsApple() && IsSkylake(device) && GetMacOSVersion() < OSVersion(10, 13, 2)isIntel || isAMDIsLinux() && functions->standard == STANDARD_GL_DESKTOP && isAMD(IsApple() && functions->standard == STANDARD_GL_DESKTOP) || (IsLinux() && isAMD)IsApple() && functions->standard == STANDARD_GL_DESKTOP && GetMacOSVersion() < OSVersion(10, 11, 0)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 0)IsApple() && isAMDIsAndroid() && isQualcommfunctions->standard == STANDARD_GL_DESKTOP && isNvidiaIsApple() || isNvidiafunctions->isAtMostGL(gl::Version(4, 1)) || (functions->standard == STANDARD_GL_DESKTOP && isAMD)isAMD || IsAndroid()IsAndroid() || isNvidia(IsAndroid() && isQualcomm) || (isIntel && IsApple())isAMD || isIntelIsNexus5X(vendor, device)IsAndroid() || (IsWindows() && isIntel)(IsWindows() && (isIntel || isAMD)) || (IsLinux() && isNvidia) || IsIOS() || IsAndroid() || IsAndroidEmulator(functions)IsAndroid() || limitMaxTextureSizeIsAndroid() || (IsApple() && (isIntel || isAMD || isNvidia))limitMaxTextureSizeIsApple()IsAndroid() || isAMD || !functions->hasExtension("GL_KHR_robust_buffer_access_behavior")IsApple() && isIntel && GetMacOSVersion() >= OSVersion(10, 12, 4)IsApple() && isIntel && GetMacOSVersion() < OSVersion(10, 12, 6)IsLinux() || (IsAndroid() && isNvidia) || (IsWindows() && isNvidia) || (IsApple() && functions->standard == STANDARD_GL_ES)IsApple() || (IsLinux() && isAMD)functions->standard == STANDARD_GL_DESKTOP && functions->isAtLeastGL(gl::Version(3, 1)) && !functions->isAtLeastGL(gl::Version(4, 3))features->emulatePrimitiveRestartFixedIndex.enabled && IsApple() && isIntelIsApple() || IsAndroid() || IsWindows()!isIntel && functions->standard == STANDARD_GL_ES && functions->isAtLeastGLES(gl::Version(3, 1)) && functions->hasGLESExtension("GL_EXT_texture_norm16")IsWindows() && isAMDIsLinux() && isAMD && isMesa && mesaVersion < (std::array<int, 3>{19, 3, 5})(IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))IsApple() && functions->standard == STANDARD_GL_ES && !(isAMD && IsWindows())isAppleisD
Source: rustdesk.exe, 00000003.00000003.710240399.000001D3A4E1C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V yvkpwbgnffyftmq Bus Provider Pipes=A
Source: rustdesk.exe, 00000009.00000003.638834822.0000016086F20000.00000004.00000020.00020000.00000000.sdmp, rustdesk.exe, 00000009.00000003.633510379.0000016086F2D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: p^^^`ecippolihcdnpedkjigedjkniaXUWVUTTTTUVWXYYYYYYYYYYYYYYYYYXXXWWWWWWWWWWWXXYZZ\^`abeeeeeecbb``__^_^^^]]]]]^^___________`````aaaaaaaaaaaaaaaabbcdeeefddddehhgfssghhhikjihggffffffffffffffffffffffffffffffffffffffffffffffffffeeeeeeeeeeeeeeeeeffgggggffggghhhhhhhhhhhhhhhhhiijjjkkkmnpqrsstuuwxvut{y{{xvussttttvvy
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: IIBroadcomGoogleMesaMicrosoftSamsung Electronics Co., Ltd.VivanteVMwareTest
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: rustdesk.exe, 00000003.00000003.649646413.000001D3AF704000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VHyper-V Virtual Machine Bus Provider Pipes
Source: rustdesk.exe, 00000003.00000003.627694069.000001D3A6921000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rustdesk.exe, 00000003.00000003.653870397.000001D3AFB10000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: t6Virtual TLB Flush Entires/sec5298Recommended Virtual TLB Size53004K GPA pages53022M GPA pages53041G GPA pages5306512G GPA pages53084K device pages53102M device pages53121G device pages5314512G device pages5316Attached Devices5318Device Interrupt Mappings5320I/O TLB Flushes/sec5322I/O TLB Flush Cost5324Device Interrupt Errors5326Device DMA Errors5328Device Interrupt Throttle Events5330Skipped Timer Ticks5332Partition Id5334Nested TLB Size5336Recommended Nested TLB Size5338Nested TLB Free List Size5340Nested TLB Trimmed Pages/sec5342I/O TLB Flushes Base5344Hyper-V Hypervisor Root Virtual Processor5346Total Run Time5348Hypervisor Run Time5350Remote Node Run Time5352Normalized Run Time5354Hypercalls/sec5356Hypercalls Cost5358Page Invalidations/sec5360Page Invalidations Cost5362Control Register Acc
Source: rustdesk.exe, 00000009.00000002.649740626.00007FF80E518000.00000002.00000001.01000000.0000000F.sdmp Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: rustdesk.exe, 00000003.00000003.627621525.000001D3A6B9E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF53D10 LoadLibraryA,GetProcAddress,GetProcAddress,FindWindowW,DispatchToUniLinksDesktop,ShowWindow,SetForegroundWindow,AttachConsole,IsDebuggerPresent,CoInitializeEx,GetMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CoUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 8_2_00007FF70EF53D10
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF53D10 LoadLibraryA,GetProcAddress,GetProcAddress,FindWindowW,DispatchToUniLinksDesktop,ShowWindow,SetForegroundWindow,AttachConsole,IsDebuggerPresent,CoInitializeEx,GetMessageW,TranslateMessage,DispatchMessageW,GetMessageW,CoUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn, 8_2_00007FF70EF53D10
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF70450 GetProcessHeap, 8_2_00007FF70EF70450
Enables debug privileges
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Memory allocated: page read and write | page guard Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF5B048 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF70EF5B048
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF5B680 SetUnhandledExceptionFilter, 8_2_00007FF70EF5B680
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF5B49C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF70EF5B49C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF60AD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF70EF60AD8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CB13E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811CB13E8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CAB9B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF811CAB9B8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CABD50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811CABD50
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D449EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF811D449EC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D4A118 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811D4A118
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DB32D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF811DB32D8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DB3670 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811DB3670
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811DB8D68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811DB8D68
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E413E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811E413E8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E3B9E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00007FF811E3B9E8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811E3BD80 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811E3BD80
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811ECD4B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00007FF811ECD4B0
Uses taskkill to terminate processes
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM RuntimeBroker_rustdesk.exe
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\icacls.exe "icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\rustdesk.exe" --portable-service Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe "C:\Users\user\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Process created: C:\Windows\System32\cmd.exe cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM RuntimeBroker_rustdesk.exe
Source: rustdesk.exe, 00000003.00000003.627369481.000001D3A6929000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\flutter_assets VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\flutter_assets\assets VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\flutter_assets\packages\dash_chat_2\assets VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\flutter_assets\packages\window_manager\images VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rustdesk-1.2.2-x86_64.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\RustDeskIddDriver VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ProgramData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\app.so VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\app.so VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\app.so VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\app.so VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\app.so VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Local\rustdesk\data\flutter_assets VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config\RustDesk.toml VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\config VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log\portable-service VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Program Files VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log\portable-service VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\Users\user\AppData\Roaming\RustDesk\log\portable-service VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF70EF7289C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF70EF69750
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF70EF72650
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF70EF725B8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF70EF724E8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF70EF72BD0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: try_get_function,GetLocaleInfoW, 8_2_00007FF70EF69BF4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF70EF72AA4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 8_2_00007FF70EF7219C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF70EF729F4
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: try_get_function,GetLocaleInfoW, 8_2_00007FF811CC42D8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF811CCE470
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoEx, 8_2_00007FF811CAA364
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811CCE64C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811CC3CA0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 8_2_00007FF811CCDC18
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811CCE034
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811CCDF64
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811D5C9D0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF811D671A0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 8_2_00007FF811D66948
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811D66C94
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811D6737C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811D66D64
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoEx, 8_2_00007FF811D43094
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: try_get_function,GetLocaleInfoW, 8_2_00007FF811D5D008
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF811DCF260
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: try_get_function,GetLocaleInfoW, 8_2_00007FF811DC5CDC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF811DCF468
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF811DCF3B8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 8_2_00007FF811DCEB60
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811DCEEAC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811DCF594
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811DC5838
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811DCF014
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811DCEF7C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: try_get_function,GetLocaleInfoW, 8_2_00007FF811E542D8
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF811E5E470
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoEx, 8_2_00007FF811E3A464
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF811E5E318
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811E5E64C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW, 8_2_00007FF811E5E520
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811E53CA0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 8_2_00007FF811E5DC18
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811E5E0CC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811E5E034
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW, 8_2_00007FF811E5DF64
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00007FF811EF0210
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00007FF811EF03EC
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF6ECA0 cpuid 8_2_00007FF70EF6ECA0
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF70EF5B6EC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 8_2_00007FF70EF5B6EC
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811CC886C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation, 8_2_00007FF811CC886C
Source: C:\Users\user\AppData\Local\rustdesk\rustdesk.exe Code function: 8_2_00007FF811D08A01 GetVersion, 8_2_00007FF811D08A01

Stealing of Sensitive Information
barindex
Yara detected BazaLoader
Source: Yara match File source: 00000000.00000003.620137708.000001924988B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\rustdesk\librustdesk.dll, type: DROPPED

Remote Access Functionality
barindex
Yara detected BazaLoader
Source: Yara match File source: 00000000.00000003.620137708.000001924988B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.620182970.0000019249751000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\rustdesk\dylib_virtual_display.dll, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\rustdesk\librustdesk.dll, type: DROPPED
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1315930 Sample: rustdesk-1.2.2-x86_64.exe Startdate: 28/09/2023 Architecture: WINDOWS Score: 45 47 rs-ny.rustdesk.com 2->47 53 Multi AV Scanner detection for submitted file 2->53 55 Yara detected BazaLoader 2->55 9 rustdesk-1.2.2-x86_64.exe 104 2->9         started        signatures3 process4 file5 39 C:\Users\user\AppData\Local\...\rustdesk.exe, PE32+ 9->39 dropped 41 C:\Users\user\AppData\...\librustdesk.dll, PE32+ 9->41 dropped 43 C:\Users\user\...\dylib_virtual_display.dll, PE32+ 9->43 dropped 45 13 other files (none is malicious) 9->45 dropped 12 rustdesk.exe 38 9->12         started        16 taskkill.exe 1 9->16         started        process6 dnsIp7 49 rs-ny.rustdesk.com 155.138.247.159, 21115, 21116, 49307 AS-CHOOPAUS United States 12->49 57 Query firmware table information (likely to detect VMs) 12->57 18 rustdesk.exe 2 12->18         started        20 cmd.exe 12->20         started        22 icacls.exe 1 12->22         started        26 2 other processes 12->26 24 conhost.exe 16->24         started        signatures8 process9 process10 28 rustdesk.exe 18->28         started        31 conhost.exe 20->31         started        33 taskkill.exe 20->33         started        35 conhost.exe 22->35         started        37 conhost.exe 26->37         started        dnsIp11 51 192.168.2.1 unknown unknown 28->51
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
155.138.247.159
 rs-ny.rustdesk.com United States
20473 AS-CHOOPAUS false

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
rs-ny.rustdesk.com 155.138.247.159 true