File name:

SeagateToolkit.exe

Full analysis: https://app.any.run/tasks/e64f05b2-9cfb-4672-911d-5c507c11079c
Verdict: Malicious activity
Analysis date: April 25, 2025, 15:34:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

BC6E60534E7BB6890D9448DADA315385

SHA1:

1342118DB5B288A9090DAD4D669827D23D178E18

SHA256:

C992FBE0C5B21F1ABF0A6840260CBD87BD69EA75078F2585D9DFB8F3C93122E7

SSDEEP:

98304:KRlhIGjwckJnX12HEfyoY1DiKoV8MfU0oYbnrr2zfJv2TXNZrtq6e0/ww0ce/Un0:a1D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SeagateToolkit.exe (PID: 1280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)

    • Searches for installed software

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)

    • Reads security settings of Internet Explorer

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)

    • Drops 7-zip archiver for unpacking

      • SeagateToolkit.exe (PID: 1280)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 4976)
      • SeagateToolkit.exe (PID: 1280)

    • Creates a software uninstall entry

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)

    • The process creates files with name similar to system file names

      • 7za.exe (PID: 4976)
      • SeagateToolkit.exe (PID: 1280)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2772)

    • Executes as Windows Service

      • ToolkitService.exe (PID: 6668)

    • There is functionality for taking screenshot (YARA)

      • SeagateToolkit.exe (PID: 1280)

    • Starts CMD.EXE for commands execution

      • Toolkit.exe (PID: 6944)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4932)

    • Creates a new Windows service

      • sc.exe (PID: 6476)

  • INFO

    • Creates files or folders in the user directory

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)
      • Upgrader.exe (PID: 7052)

    • Checks supported languages

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)

    • Checks proxy server information

      • SeagateToolkit.exe (PID: 1280)

    • Reads the software policy settings

      • SeagateToolkit.exe (PID: 1280)

    • The sample compiled with english language support

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)

    • Reads the machine GUID from the registry

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)

    • Reads the computer name

      • SeagateToolkit.exe (PID: 1280)
      • 7za.exe (PID: 4976)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)
      • ToolkitService.exe (PID: 6668)
      • Upgrader.exe (PID: 7052)

    • Process checks computer location settings

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
      • ServiceControl.exe (PID: 6572)
      • ServiceControl.exe (PID: 1096)

    • Creates files in the program directory

      • SeagateToolkit.exe (PID: 1280)
      • Upgrader.exe (PID: 7052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (3.6)
.exe | Generic Win/DOS Executable (1.6)
.exe | DOS Executable Generic (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:11 21:10:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 1756160
InitializedDataSize: 3142656
UninitializedDataSize: -
EntryPoint: 0x16cd3b
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.31.0.16
ProductVersionNumber: 2.31.0.16
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Seagate
FileDescription: Installer
FileVersion: 2.31.0.16
InternalName: Installer.exe
LegalCopyright: Copyright (c) 2025 Seagate Technology LLC
OriginalFileName: Installer.exe
ProductName: Toolkit
ProductVersion: 2.31.0.16
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
24
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start seagatetoolkit.exe sppextcomobj.exe no specs slui.exe no specs 7za.exe conhost.exe no specs upgrader.exe no specs servicecontrol.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs servicecontrol.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs toolkitservice.exe toolkit.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs getcontrollers.exe no specs conhost.exe no specs 7za.exe no specs conhost.exe no specs seagatetoolkit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ServiceControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ServiceControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Toolkit\7za.exe" x "C:\Users\admin\AppData\Roaming\Toolkit\Devices\iconzip_v2.28.2.zip" -aoa -o"C:\Users\admin\AppData\Roaming\Toolkit\Devices"C:\Program Files (x86)\Toolkit\7za.exe—Toolkit.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
21.07
Modules
Images
c:\program files (x86)\toolkit\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll
1096"C:\Program Files (x86)\Toolkit\ServiceControl.exe" C:\Program Files (x86)\Toolkit\ServiceControl.exe—Upgrader.exe
User:
admin
Integrity Level:
HIGH
Description:
ServiceControl
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\toolkit\servicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1096"C:\Program Files (x86)\Toolkit\Service\GetControllers.exe"C:\Program Files (x86)\Toolkit\Service\GetControllers.exe—ToolkitService.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
GetControllers
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files (x86)\toolkit\service\getcontrollers.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1280"C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe" C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe
explorer.exe
User:
admin
Company:
Seagate
Integrity Level:
HIGH
Description:
Installer
Exit code:
2
Version:
2.31.0.16
Modules
Images
c:\users\admin\appdata\local\temp\seagatetoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2088C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2656"C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe" C:\Users\admin\AppData\Local\Temp\SeagateToolkit.exe—explorer.exe
User:
admin
Company:
Seagate
Integrity Level:
MEDIUM
Description:
Installer
Exit code:
3221226540
Version:
2.31.0.16
Modules
Images
c:\users\admin\appdata\local\temp\seagatetoolkit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
5 374
Read events
5 346
Write events
28
Delete events
0

Modification events

(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto-Regular (TrueType)
Value:
Roboto-Regular.ttf
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Toolkit
Value:
"C:\Program Files (x86)\Toolkit\Toolkit.exe" /WinStart
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayName
Value:
Toolkit
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\Toolkit
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:Publisher
Value:
Seagate
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:From
Value:
Seagate
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:HelpLink
Value:
https://www.seagate.com
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayVersion
Value:
2.31.0.59
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Toolkit\uninstaller.exe"
(PID) Process:(1280) SeagateToolkit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Toolkit
Operation:writeName:DisplayIcon
Value:
"C:\Program Files (x86)\Toolkit\uninstaller.exe"
Executable files
115
Suspicious files
121
Text files
1 127
Unknown types
0

Dropped files

PID
Process
Filename
Type
1280SeagateToolkit.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Roboto-Regular.ttfbinary
MD5:3E1AF3EF546B9E6ECEF9F3BA197BF7D2
SHA256:79E851404657DAC2106B3D22AD256D47824A9A5765458EDB72C9102A45816D95
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\02460F0C5E46824211DA37830EBE26EFbinary
MD5:0D4F778C17B4DDA0F9BDE4B9D1DC9E07
SHA256:471B04782B9958D95F6455D3819E74B8F4D5757F90EA27ECA01BBFBAABE72B56
1280SeagateToolkit.exeC:\Users\admin\AppData\Roaming\Toolkit\Log\Install.logtext
MD5:4701704D6636D2996DBA34E32E3B6154
SHA256:F32AE03CC56457DEEC9DE39972D90F5E926017CE9B1B916DB25435454257092F
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\DeviceManage.dllexecutable
MD5:C108C2A075596890526CEAEC57451CB1
SHA256:AD16D13BA891D8587C2C44F0A0EF87B3C41BABC8A78C8B799086947AEBF0322D
1280SeagateToolkit.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\server.initext
MD5:556DE13B2E00BFA7B2DFA90006C6D871
SHA256:18E6E5D80EE2F1C7E21E953E4F181C4334E524F3FFF344C9E06444D861E5216C
1280SeagateToolkit.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\02460F0C5E46824211DA37830EBE26EFbinary
MD5:7E126F8FD66A567B667763F020B309DF
SHA256:D0FD148F0C03F8B76977303FF49352C74881166DEBA03836344A57F87CDC01DD
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\HidLibrary.dllexecutable
MD5:524DDB9CBC51BF4331D0A6BC47833B68
SHA256:C50C062F00155D2664FCAC9DDC69B45AB35284B5378795E0611F40EAA52700CF
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\CommonUtils.dllexecutable
MD5:F55E654FEB5F8545E8631AEB7297CA51
SHA256:3963FFB662B0CB1D438E3A735FEFA9A16A422EAA1DDBA69BD226A7D2D57BAB75
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\FwUpdateAPI.dllexecutable
MD5:C9DBA67D35CFCC443FAA893D857026E7
SHA256:B33D51CC803ED2A3A5F9D0735CD71C8B989FEBADE02BC16761D5A629CC104857
49767za.exeC:\Users\admin\AppData\Roaming\Toolkit\Temp\Toolkit_2.31.0.59\FwUpdateDriverAPI.dllexecutable
MD5:909BF06CB505BF3A34607EFC4E97853B
SHA256:C7740D2F308544822EDAE4A98BC7AB296D45E62C89BC752F60B27155C2419DC5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
26
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1280
SeagateToolkit.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEQCtjS32RoGg02RH6qlPonPB
unknown
—
—
whitelisted
1280
SeagateToolkit.exe
GET
200
18.244.18.60:80
http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
unknown
—
—
whitelisted
1040
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1040
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1280
SeagateToolkit.exe
172.64.145.31:443
www.seagate.com
CLOUDFLARENET
US
whitelisted
1280
SeagateToolkit.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
1280
SeagateToolkit.exe
18.244.18.60:80
crls.ssl.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.153
  • 23.48.23.158
  • 23.48.23.156
  • 23.48.23.148
  • 23.48.23.134
  • 23.48.23.194
  • 23.48.23.143
  • 23.48.23.141
  • 23.48.23.150
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
www.seagate.com
  • 172.64.145.31
  • 104.18.42.225
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
crls.ssl.com
  • 18.244.18.60
  • 18.244.18.55
  • 18.244.18.54
  • 18.244.18.92
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.68
  • 40.126.31.129
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted

Threats

No threats detected
Process
Message
ToolkitService.exe
20250425 15:35:08 817|E|8|ToolkitService|Reload ToolkitService Log, Path = C:\Users\admin\AppData\Roaming\Toolkit\Log
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SeagateToolkit.exe