EchoTrail

RustDesk 1.5.0

by Purslane Tech Pte. Ltd.installer signed by PURSLANEValid

Sources: observed in the EchoTrail lab on Windows 11 on October 27, 2026.

The install

Installer
rustdesk-1.5.0-x86_64.exe
Installed through
the window clicker
Install directory
C:\Users\lab\AppData\Local\rustdesk
Launched
rustdesk.exe
Windows
Windows 11
Date
October 27, 2026
Executables dropped
20

installer sha256 8555777215510d83d2d61c9dc984e4fcc838bd7e79f9d18a42585431f5e8bb47

The lab used RustDesk for 1 minute, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to RustDesk's own windows.

RustDesk 1.5.0: First window
First window. RustDesk main window showing the ID, one-time password, an Install banner and a Control Remote Desktop panel.
RustDesk 1.5.0: Settings
Settings. RustDesk Settings page is open on the General tab showing Service, Theme, Language and Hardware codec options.

What it dropped

Executables

  • librustdesk.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\librustdesk.dll
    sha256 da4889603c26c6c29fdaa4bb3aec857f9e714e9e795a2c031184bff78fe7c597
  • flutter_windows.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\flutter_windows.dll
    sha256 1b9c8b836389d35102f473b53d7f6a8a75030ad36f7a69c0a3f4790873de0a80
  • printer_driver_adapter.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\printer_driver_adapter.dll
    sha256 929956a8e3340ce11b9b7e03320d2f96a76c869411680fe3ba15af8758d265ad
  • window_manager_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\window_manager_plugin.dll
    sha256 dd4dcde51e94f518e339faf5a2f0ae4998091df3726aa0c24a7e5e0832ae1e38
  • uni_links_desktop_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\uni_links_desktop_plugin.dll
    sha256 2b7b539333bfc35c8b0959d6c4ee601ab99accad23833b28f325047ca770be2c
  • screen_retriever_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\screen_retriever_plugin.dll
    sha256 faf698be57024e506f975a43117371bd28ff42eb4f23929d4b641f4e916f2589
  • window_size_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\window_size_plugin.dll
    sha256 7f842fbaf23e91ebff124bb8e20816c62b01b1a97d7ea43f1299af14f4ba72ee
  • desktop_multi_window_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\desktop_multi_window_plugin.dll
    sha256 4191b3cffaa6ed716715389cb784bd110aa48b6b51529caf23f9e3e541e2d329
  • rustdesk.exesigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValidran during the lab session
    C:\Users\lab\AppData\Local\rustdesk\rustdesk.exe
    sha256 7f6d1e09e5a9924f567962aa57a6b126b409bed4775d98074c727420438768dc
  • file_selector_windows_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\file_selector_windows_plugin.dll
    sha256 4e6004c1e9e44176505d4e4f4640b4afef53d5b38d41e453edd6ef5a8571548a
  • flutter_gpu_texture_renderer_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\flutter_gpu_texture_renderer_plugin.dll
    sha256 bc8ffc7e658b230603d4f30c168853287fd201662092f81684a4fbf8fadb01a9
  • url_launcher_windows_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\url_launcher_windows_plugin.dll
    sha256 f7c2458fdd76988052278d944043b9c7bb54dd962a463270b98716895f955af4
  • desktop_drop_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\desktop_drop_plugin.dll
    sha256 115031cdd2d7026d1e24cf9b1549bc294bbd9dcce174f67dcdc0c687c8d6c3fb
  • texture_rgba_renderer_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\texture_rgba_renderer_plugin.dll
    sha256 27b3114041df39fa550dbf83748d655104961bfc10d51f28ff215f1a9317db02
  • flutter_custom_cursor_plugin.dllsigned by CN=PURSLANE, O=PURSLANE, S=North West, C=SG, OID.2.5.4.15=Business Entity, OID.1.3.6.1.4.1.311.60.2.1.3=SG, SERIALNUMBER=53481265AValid
    C:\Users\lab\AppData\Local\rustdesk\flutter_custom_cursor_plugin.dll
    sha256 05b03480a9b044acb99db088191f3892f8e7ed6355d0cc1e065ea06f0d231af7
  • dylib_virtual_display.dll
    C:\Users\lab\AppData\Local\rustdesk\dylib_virtual_display.dll
    sha256 b9a51a5d639c3dd96883d2ddeb60e1fc3e57ba26ee2cdbc24572f1b3e65dd5cf
  • runtimebroker_rustdesk.exesigned by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
    C:\Users\lab\AppData\Local\rustdesk\RuntimeBroker_rustdesk.exe
    sha256 8de24f8e51cc05db2581b6240b834acecbb0e012b8722cc3365f884d7ba4b409
  • usbmmidd.dll
    C:\Users\lab\AppData\Local\rustdesk\usbmmidd_v2\x64\usbmmIdd.dll
    sha256 dc135d675127113915a7e5aa9fe57c84edad6be41d0890b265ef124ab26ea9e3
  • windowinjection.dll
    C:\Users\lab\AppData\Local\rustdesk\WindowInjection.dll
    sha256 231ea21b53762a1c58d374bc9f650e4b45ea08f62a1b25420309f0a0451598e1
  • rustdeskprinterdriverrenderfilter.dll
    C:\Users\lab\AppData\Local\rustdesk\drivers\RustDeskPrinterDriver\RustDeskPrinterDriverRenderFilter.dll
    sha256 43ede110ffb779ec6f28339a11945414696ce55253f7826d5dbb64e9633506cd

What it talked to

Destinations

  • 209.250.254.15:21116asked by rustdesk.exe12 connections
  • 209.250.254.15:21115asked by rustdesk.exe
  • 209.250.254.15:21116asked by rustdesk.exe
  • 49.12.46.241:443asked by rustdesk.exe

DNS

  • rs-ny.rustdesk.comasked by rustdesk.exe
  • api.rustdesk.comasked by rustdesk.exe
  • stun.antisip.comasked by rustdesk.exe
  • stun.cloudflare.comasked by rustdesk.exe
  • stun.l.google.comasked by rustdesk.exe
  • stun.nextcloud.comasked by rustdesk.exe