File name:

SeagateToolkit.exe

Full analysis: https://app.any.run/tasks/e64f05b2-9cfb-4672-911d-5c507c11079c
Verdict: Malicious activity
Analysis date: April 25, 2025, 15:34:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

BC6E60534E7BB6890D9448DADA315385

SHA1:

1342118DB5B288A9090DAD4D669827D23D178E18

SHA256:

C992FBE0C5B21F1ABF0A6840260CBD87BD69EA75078F2585D9DFB8F3C93122E7

SSDEEP:

98304:KRlhIGjwckJnX12HEfyoY1DiKoV8MfU0oYbnrr2zfJv2TXNZrtq6e0/ww0ce/Un0:a1D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SeagateToolkit.exe (PID: 1280)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)

    • Searches for installed software

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)

    • Executable content was dropped or overwritten

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)

    • Drops 7-zip archiver for unpacking

      • SeagateToolkit.exe (PID: 1280)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 4976)
      • SeagateToolkit.exe (PID: 1280)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 4976)
      • SeagateToolkit.exe (PID: 1280)

    • Creates a software uninstall entry

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2772)

    • Creates a new Windows service

      • sc.exe (PID: 6476)

    • Executes as Windows Service

      • ToolkitService.exe (PID: 6668)

    • Starts CMD.EXE for commands execution

      • Toolkit.exe (PID: 6944)

    • There is functionality for taking screenshot (YARA)

      • SeagateToolkit.exe (PID: 1280)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4932)

  • INFO

    • Checks supported languages

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)
      • ServiceControl.exe (PID: 6572)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)

    • Creates files or folders in the user directory

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)
      • Upgrader.exe (PID: 7052)

    • The sample compiled with english language support

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)

    • Checks proxy server information

      • SeagateToolkit.exe (PID: 1280)

    • Reads the computer name

      • SeagateToolkit.exe (PID: 1280)
      • ServiceControl.exe (PID: 6572)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)
      • 7za.exe (PID: 4976)

    • Reads the software policy settings

      • SeagateToolkit.exe (PID: 1280)

    • Reads the machine GUID from the registry

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)

    • Process checks computer location settings

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)

    • Creates files in the program directory

      • Upgrader.exe (PID: 7052)
      • SeagateToolkit.exe (PID: 1280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:11 21:10:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 1756160
InitializedDataSize: 3142656
UninitializedDataSize: -
EntryPoint: 0x16cd3b
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.31.0.16
ProductVersionNumber: 2.31.0.16
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Seagate
FileDescription: Installer
FileVersion: 2.31.0.16
InternalName: Installer.exe
LegalCopyright: Copyright (c) 2025 Seagate Technology LLC
OriginalFileName: Installer.exe
ProductName: Toolkit
ProductVersion: 2.31.0.16
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
24
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start seagatetoolkit.exe sppextcomobj.exe no specs slui.exe no specs 7za.exe conhost.exe no specs upgrader.exe no specs servicecontrol.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs servicecontrol.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs toolkitservice.exe toolkit.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs getcontrollers.exe no specs conhost.exe no specs 7za.exe no specs conhost.exe no specs seagatetoolkit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ServiceControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ServiceControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Toolkit\7za.exe" x "C:\Users\admin\AppData\Roaming\Toolkit\Devices\iconzip_v2.28.2.zip" -aoa -o"C:\Users\admin\AppData\Roaming\Toolkit\Devices"C:\Program Files (x86)\Toolkit\7za.exe—Toolkit.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
21.07
Modules
Images
c:\program files (x86)\toolkit\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
1096"C:\Program Files (x86)\Toolkit\ServiceControl.exe" C:\Program Files (x86)\Toolkit\ServiceControl.exe—Upgrader.exe
User:
admin
Integrity Level:
HIGH
Description:
ServiceControl
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\toolkit\servicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1096"C:\Program Files (x86)\Toolkit\Service\GetControllers.exe"C:\Program Files (x86)\Toolkit\Service\GetControllers.exe—ToolkitService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
GetControllers
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\toolkit\service\getcontrollers.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1280"C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe" C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe
explorer.exe
User:
admin
Company:
Seagate
Integrity Level:
HIGH
Description:
Installer
Exit code:
2
Version:
2.31.0.16
Modules
Images
c:\users\admin\appdata\local\temp\seagatetoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2088C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2656"C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe" C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe—explorer.exe
User:
admin
Company:
Seagate
Integrity Level:
MEDIUM
Description:
Installer
Exit code:
3221226540
Version:
2.31.0.16
Modules
Images
c:\users\admin\appdata\local\temp\seagatetoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
5 374
Read events
5 346
Write events
28
Delete events
0

Modification events

(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto-Regular (TrueType)
Value:
Roboto-Regular.ttf
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Toolkit
Value:
"C:\Program Files (x86)\Toolkit\Toolkit.exe" /WinStart
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayName
Value:
Toolkit
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Toolkit
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:Publisher
Value:
Seagate
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:From
Value:
Seagate
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:HelpLink
Value:
https://www.seagate.com
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayVersion
Value:
2.31.0.59
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Toolkit\uninstaller.exe"
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayIcon
Value:
"C:\Program Files (x86)\Toolkit\uninstaller.exe"
Executable files
115
Suspicious files
121
Text files
1 127
Unknown types
0

Dropped files

PID
Process
Filename
Type
1280SeagateToolkit.exeC:\Windows\Fonts\Roboto-Regular.ttfbinary
MD5:3E1AF3EF546B9E6ECEF9F3BA197BF7D2
SHA256:79E851404657DAC2106B3D22AD256D47824A9A5765458EDB72C9102A45816D95
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_0E7D957F8CAC4DE448BF5D34E62E9B04binary
MD5:C5CC2C4F5BAE532DFB04A8C110D375A8
SHA256:5CF87CB86A971E4F46F0BE38C13DA964887FA5882FA103317E217487D9C0BC8F
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\02460F0C5E46824211DA37830EBE26EFbinary
MD5:7E126F8FD66A567B667763F020B309DF
SHA256:D0FD148F0C03F8B76977303FF49352C74881166DEBA03836344A57F87CDC01DD
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\7za.exeexecutable
MD5:1478DA9DDC92CE24551F03D78752756C
SHA256:C23A821B33E68ED64FF1A2498F066CC24FA95BB76CB5A59227BC044F55D35A82
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\DeviceManage.dllexecutable
MD5:C108C2A075596890526CEAEC57451CB1
SHA256:AD16D13BA891D8587C2C44F0A0EF87B3C41BABC8A78C8B799086947AEBF0322D
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_0E7D957F8CAC4DE448BF5D34E62E9B04binary
MD5:D729BE081FA5A28F3EF6AE99A608515D
SHA256:B37A8AD5D476DE5F8577419F514D795C009D553F7D49B5C4F58A8DA31AB6D89E
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\AlphaFS.dllexecutable
MD5:8FF9B5C01C39E987835195124C0BC92B
SHA256:C5A02C0EB57D2E0CF6641094B66B055603D92E952FBA19A9805DB77CDE0483F3
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\BouncyCastle.Crypto.dllexecutable
MD5:766A3AC6AFF09F3650F408446553A346
SHA256:0E70A3F73F747B4CA3D64015E82C5B74D23C71B92A673CB044D27CE8A6D2CA05
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\02460F0C5E46824211DA37830EBE26EFbinary
MD5:0D4F778C17B4DDA0F9BDE4B9D1DC9E07
SHA256:471B04782B9958D95F6455D3819E74B8F4D5757F90EA27ECA01BBFBAABE72B56
1280SeagateToolkit.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Roboto-Regular.ttfbinary
MD5:3E1AF3EF546B9E6ECEF9F3BA197BF7D2
SHA256:79E851404657DAC2106B3D22AD256D47824A9A5765458EDB72C9102A45816D95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1040
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1280
SeagateToolkit.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCtjS32RoGg02RH6qlPonPB
unknown
—
—
whitelisted
1280
SeagateToolkit.exe
GET
200
18.244.18.60:80
http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
unknown
—
—
whitelisted
1040
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1280
SeagateToolkit.exe
172.64.145.31:443
www.seagate.com
CLOUDFLARENET
US
whitelisted
1280
SeagateToolkit.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
1280
SeagateToolkit.exe
18.244.18.60:80
crls.ssl.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.153
  • 23.48.23.158
  • 23.48.23.156
  • 23.48.23.148
  • 23.48.23.134
  • 23.48.23.194
  • 23.48.23.143
  • 23.48.23.141
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
www.seagate.com
  • 172.64.145.31
  • 104.18.42.225
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
crls.ssl.com
  • 18.244.18.60
  • 18.244.18.55
  • 18.244.18.54
  • 18.244.18.92
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.129
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted

Threats

No threats detected
Process
Message
ToolkitService.exe
20250425 15:35:08 817|E|8|ToolkitService|Reload ToolkitService Log, Path = C:\Users\admin\AppData\Roaming\Toolkit\Log
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SeagateToolkit.exe