RMM

AnyDesk

AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RMM
Research authors: Ali Alwashali, Nasreddine Bencherchali
Created: 2023-09-29
Last modified: 2026-10-11
Privileges: User
Free / availability: Yes
Verification required: No
Supported platforms: AndroidChromeOSLinuxWindowsiOSmacOS

Capabilities

File TransferFile System AccessRemote ControlGUI SupportCommand line Support

Known vulnerabilities

https://www.cvedetails.com/vulnerability-list/vendor_id-16953/product_id-40173/Anydesk-Anydesk.html
AnyPwn: pre-authentication heap overflow in AnyDesk for Linux 8.0.2 over TCP 7070 leading to root, fixed in 8.0.3 (no CVE)

Executables & installation paths

Filename: anydesk.exe
OriginalFileName: AnyDesk.exe
Description: AnyDesk
Product: AnyDesk

Installation paths

C:\Program Files (x86)\AnyDesk\*

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

C:\Program Files\AnyDesk\*

C:\Program Files (x86)\AnyDesk-*\*

C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe

C:\Program Files\AnyDesk-*\AnyDesk-*.exe

/Applications/AnyDesk.app

Code signing

signer name: AnyDesk Software GmbH
certificate thumbprint: E5ABE8D3CEA37B45F3D3896B49FB91920B4A4E9D
src file sha256: 864e2c3675d05cd4816a42167b45ab66e3d5995fae7e1fd680223940061b9803
src file path: downloaded_files/anydesk/864e2c3675d05cd4816a42167b45ab66e3d5995fae7e1fd680223940061b9803
src file company: AnyDesk Software GmbH

signer name: AnyDesk Software GmbH
certificate thumbprint: D056FB932C5A4821C328214E4F4988436650583A

FORENSIC EVIDENCE

Disk artifacts

File

%programdata%\AnyDesk\ad_svc.trace

Description

AnyDesk service log file. As well as ad.trace, we can determine the IP address of the other participant and its AnyDesk ID when a connection is established.

OS

Windows

Example

info 2022-08-23 10:20:11.969 gsvc 4628 3528 3 anynet.relay_conn - External address: 34.xx.xx.123:46798

File

%programdata%\AnyDesk\connection_trace.txt

Description

Incoming connection request log recording date/time, requesting AnyDesk ID, and acceptance or rejection. Approval values include User (interactive acceptance), Passwd (unattended-access password authentication), and Token (saved-login token authentication). Token authentication does not mean the plaintext password was stored.

OS

Windows

Example

Incoming 2022-08-23, 10:23 Passwd 547911884 547911884
Incoming 2022-09-28, 12:39 User 442226597 442226597
Incoming 2026-06-26, 15:42 Token (AnyDesk IDs omitted)

File

%APPDATA%\AnyDesk\connection_trace.txt

Description

OS

Windows

Example

Incoming 2022-08-23, 10:23 Passwd 547911884 547911884
Incoming 2022-09-28, 12:39 User 442226597 442226597

File

%APPDATA%\AnyDesk\ad.trace

Description

AnyDesk user interface log file. In this log file, we can determine the IP address of the other participant and its AnyDesk ID. It is also possible to track events of file transfer. Below is the Client ID and external IP address of the remote participant.

OS

Windows

Example

info 2022-09-28 12:39:26.845 lsvc 9952 9944 21 anynet.any_socket - Client-ID: 442226597 (FPR: 8e28a2a25b30).
info 2022-09-28 12:39:26.845 lsvc 9952 9944 21 anynet.any_socket - Logged in from 12.xx.xx.21:59562 on relay 80e496c0.

File: *\AppData\Roaming\AnyDesk\file_transfer_trace.txt
Description: Plaintext file-manager transfer log observed in user-context runs under %APPDATA%\AnyDesk; records transfer timestamps, filenames, sizes, and direction. Correlate with session logs to investigate file movement.
OS: Windows

File

*\ProgramData\AnyDesk\file_transfer_trace.txt

Description

Plaintext file-manager transfer log observed in installed/service-context runs under %PROGRAMDATA%\AnyDesk; records transfer timestamps, filenames, sizes, and direction.

OS

Windows

Example

finish upload 'documents.zip' (~231.44 MiB)

File: %APPDATA%\AnyDesk\chat\*.txt
Description: If the chat functionality is used, its entries will be printed in a text file in this folder.
OS: Windows

File: %APPDATA%\AnyDesk\user.conf
Description: N/A
OS: Windows

File: %PROGRAMDATA%\AnyDesk\service.conf
Description: Password can be set to auto-validate the session. The password will be saved in a salted hash format.
OS: Windows

File: %APPDATA%\AnyDesk\service.conf
Description: N/A
OS: Windows

File: %APPDATA%\AnyDesk\system.conf
Description: N/A
OS: Windows

File: %PROGRAMDATA%\AnyDesk\system.conf
Description: N/A
OS: Windows

File: *\ProgramData\AnyDesk\ad_*\ad_*_svc.trace
Description: Custom client service trace; the wildcard covers account-specific prefixes and MSI variants.
OS: Windows

File: *\AppData\Roaming\AnyDesk\ad_*\ad_*.trace
Description: Custom client user-interface trace; the wildcard covers account-specific prefixes and MSI variants.
OS: Windows

File: *\AppData\Roaming\AnyDesk\ad_*\chat\*.txt
Description: Custom client chat log, with the account-specific prefix represented by a wildcard.
OS: Windows

File: *\AppData\Roaming\AnyDesk\ad_*\user.conf
Description: Custom client user config.
OS: Windows

File: *\AppData\Roaming\AnyDesk\ad_*\service.conf
Description: Custom client service config.
OS: Windows

File: *\ProgramData\AnyDesk\ad_*\service.conf
Description: Custom client service config.
OS: Windows

File: *\ProgramData\AnyDesk\ad_*\system.conf
Description: Custom client system config.
OS: Windows

File: %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\AnyDesk.lnk
Description: N/A
OS: Windows

File: *\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\AnyDesk *.lnk
Description: Custom client startup link.
OS: Windows

File: %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\AnyDesk\Uninstall AnyDesk.lnk
Description: N/A
OS: Windows

File: C:\Users\*\Videos\AnyDesk\*.anydesk
Description: N/A
OS: Windows

File: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\*
Description: N/A
OS: Windows

File: ~/Library/Application Support/AnyDesk/Logs/
Description: N/A
OS: Mac

File: ~/.config/AnyDesk/Logs/
Description: N/A
OS: Linux

FORENSIC EVIDENCE

Event log artifacts

EventID: 7045
ProviderName: Service Control Manager
LogFile: System.evtx
ServiceName: AnyDesk Service
ImagePath: "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
Description: Service installation event as result of AnyDesk installation.

EventID: 7045
ProviderName: Service Control Manager
LogFile: System.evtx
ServiceName: AnyDesk * Service
ImagePath: "C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe" --service
Description: Service installation event for custom per-org clients.

EventID: 4697
ProviderName: Microsoft-Security-Auditing
LogFile: Security.evtx
ServiceName: AnyDesk Service
ImagePath: "C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service
Description: Service installation event as result of AnyDesk installation.

FORENSIC EVIDENCE

Registry artifacts

Path: HKLM\SOFTWARE\Clients\Media\AnyDesk
Description: N/A

Path: HKLM\SOFTWARE\Clients\Media\AnyDesk-*
Description: Custom client media entry.

Path: HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk
Description: N/A

Path: HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk-*
Description: Custom client service registry entry; CurrentControlSet represents the active control set.

Path: HKLM\SOFTWARE\Classes\.anydesk\shell\open\command
Description: N/A

Path: HKLM\SOFTWARE\Classes\AnyDesk\shell\open\command
Description: N/A

Path: HKLM\SOFTWARE\Classes\AnyDesk-*\shell\open\command
Description: Custom client URL handler.

Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\AnyDesk Printer\*
Description: N/A

Path: HKLM\DRIVERS\DriverDatabase\DeviceIds\USBPRINT\AnyDesk
Description: N/A

Path: HKLM\DRIVERS\DriverDatabase\DeviceIds\WSDPRINT\AnyDesk
Description: N/A

Path: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk
Description: N/A

Path: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AnyDesk-*
Description: Custom client uninstall entry.

FORENSIC EVIDENCE

Network artifacts

Description

During setup the boot.net.anydesk.com domain is requested over TCP 443.

Domains

boot.net.anydesk.com

Ports

Description

Direct peer-to-peer connections use TCP 7070 by default; the listening port is configurable and direct connections can be disabled. Successful or failed direct attempts may expose the peer address in endpoint network telemetry. The address may belong to a VPN or NAT gateway and does not identify the operator.

Domains

Not recorded

Ports

7070

Description

Relay-mediated sessions connect to AnyDesk servers over TCP 80, 443, or 6568. Network telemetry for the relay connection identifies the relay address; direct connections can separately expose the peer address.

Domains