This provides you with time stamps and IDs to help focus your investigation and give you that initial hook that the baseline of a DFIR investigation. It is important to note that this is for incoming requests only, and does not display any outgoing connection data. The ‘Passwd’ and ‘Token’ settings are only relevant if the local system has set a password for unattended access.

REJECTED – if the local user has rejected the request.

Token – a ‘remember password’ check box being checked by the remote system.

Passwd – a password being entered by the remote system.

User – for the local user accepting the request.

The Connection_trace.txt file shows incoming requests with a status of Later versions uses hash check due to search order DLL vulnerabilities, which will be covered later. GCAPI.DLL is required for AnyDesk to run and for PE version may be seen in the same location as the executable, or will be seen in the Temp folder.įor user temp (PE) you will be looking by default inįor system temp (installed) files you will be lookingĪnyDesk will search for this file and download it if it is not already present. If this is from a scammer, it is most likely going to be in the Downloads folder, or the Desktop. To check which way this application is being run, look at the file properties of the AnyDesk application. However the artefacts discussed here will be the same in both locations.

The way the software is run, will dictate the artefact locations on the disk. There are also several options within AnyDesk that will allow the attacker to lock the victim out of their own machine, giving complete control to the attacker.ĪnyDesk have taken steps to present the victim with alerts, and even disallow certain actions by the remote device, but the scammers utilise social engineering techniques to bypass these easily.ĪnyDesk can be downloaded from the AnyDesk website here Technical AspectsĪnyDesk can be run in two ways installed like a tradition piece of software, or as a portable executable (PE). It is the scammer’s tool of choice because it is very easy to download and set up.

Click here to view this research on my YouTube channel What is AnyDesk?ĪnyDesk is a legitimate, non-malicious piece of software that is used by companies world wide to manage their IT systems, and can be used for free to help family members with IT issues.

Anydesk app fraud detection