File name:

imyfone-anyto_setup.exe

Full analysis: https://app.any.run/tasks/97ced0d8-7b46-4e8e-b740-786adfe9260f
Verdict: Malicious activity
Analysis date: March 19, 2025, 02:23:06
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6F702AC482B37EB0C11929DC82EDB861

SHA1:

E9A1A4125B256EEB43056DAE6C62B64E72A5F709

SHA256:

F8C133B57E252DFAE79FBE596C72396258942A1B68D9D634AAEE7BDA8875784F

SSDEEP:

98304:PLSdRMQm6oUK3CkTjYkInuBcGh7lRxRNeCdeDPgZg/Yjqqk6hsNO8liVT9NoDepJ:D42

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • imyfone-anyto_setup.exe (PID: 4164)
      • ShellExperienceHost.exe (PID: 7200)

    • Executable content was dropped or overwritten

      • imyfone-download.exe (PID: 8068)
      • imyfone-download.tmp (PID: 8092)

    • Starts CMD.EXE for commands execution

      • imyfone-download.tmp (PID: 8092)

    • Reads the Windows owner or organization settings

      • imyfone-download.tmp (PID: 8092)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 8000)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 2616)
      • cmd.exe (PID: 7724)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 6808)

    • The process drops C-runtime libraries

      • imyfone-download.tmp (PID: 8092)

    • Drops a system driver (possible attempt to evade defenses)

      • imyfone-download.tmp (PID: 8092)

    • Drops 7-zip archiver for unpacking

      • imyfone-download.tmp (PID: 8092)

    • Process drops legitimate windows executable

      • imyfone-download.tmp (PID: 8092)

  • INFO

    • Reads product name

      • imyfone-anyto_setup.exe (PID: 4164)

    • Checks supported languages

      • imyfone-anyto_setup.exe (PID: 4164)
      • imyfone-download.exe (PID: 8068)
      • imyfone-download.tmp (PID: 8092)
      • ShellExperienceHost.exe (PID: 7200)

    • Reads the computer name

      • imyfone-anyto_setup.exe (PID: 4164)
      • ShellExperienceHost.exe (PID: 7200)
      • imyfone-download.tmp (PID: 8092)

    • The sample compiled with english language support

      • imyfone-anyto_setup.exe (PID: 4164)
      • imyfone-download.tmp (PID: 8092)

    • Creates files in the program directory

      • imyfone-anyto_setup.exe (PID: 4164)
      • imyfone-download.tmp (PID: 8092)

    • Reads Environment values

      • imyfone-anyto_setup.exe (PID: 4164)

    • Checks proxy server information

      • imyfone-anyto_setup.exe (PID: 4164)
      • BackgroundTransferHost.exe (PID: 7632)
      • slui.exe (PID: 7572)

    • Reads the software policy settings

      • imyfone-anyto_setup.exe (PID: 4164)
      • BackgroundTransferHost.exe (PID: 7632)
      • slui.exe (PID: 7052)
      • slui.exe (PID: 7572)

    • Reads the machine GUID from the registry

      • imyfone-anyto_setup.exe (PID: 4164)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7420)
      • BackgroundTransferHost.exe (PID: 7632)
      • BackgroundTransferHost.exe (PID: 7792)
      • BackgroundTransferHost.exe (PID: 8008)
      • BackgroundTransferHost.exe (PID: 1196)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7632)

    • Create files in a temporary directory

      • imyfone-download.exe (PID: 8068)
      • imyfone-download.tmp (PID: 8092)

    • Detects InnoSetup installer (YARA)

      • imyfone-download.exe (PID: 8068)
      • imyfone-download.tmp (PID: 8092)

    • The sample compiled with chinese language support

      • imyfone-download.tmp (PID: 8092)

    • Compiled with Borland Delphi (YARA)

      • imyfone-download.exe (PID: 8068)
      • imyfone-download.tmp (PID: 8092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:26 03:03:11+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 2128384
InitializedDataSize: 945664
UninitializedDataSize: -
EntryPoint: 0x1bdd14
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.4.0.1
ProductVersionNumber: 4.4.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: imyfone-anyto_setup.exe
FileVersion: 4.4.0.1
LegalCopyright: Copyright (C) 2025 iMyFone. All rights reserved.
ProductName: iMyFone AnyTo
ProductVersion: 4.4.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
34
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start imyfone-anyto_setup.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe shellexperiencehost.exe no specs imyfone-download.exe imyfone-download.tmp cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs imyfone-anyto_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1672\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"cmd.exe" /c taskkill /f /t /im Feedback.exeC:\Windows\SysWOW64\cmd.exe—imyfone-download.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2284"C:\Users\admin\AppData\Local\Temp\imyfone-anyto_setup.exe" C:\Users\admin\AppData\Local\Temp\imyfone-anyto_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
imyfone-anyto_setup.exe
Exit code:
3221226540
Version:
4.4.0.1
Modules
Images
c:\users\admin\appdata\local\temp\imyfone-anyto_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2616"cmd.exe" /c taskkill /f /t /im NcmdriverInstaller.exeC:\Windows\SysWOW64\cmd.exe—imyfone-download.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3176\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3180taskkill /f /t /im ProductBox.exeC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4164"C:\Users\admin\AppData\Local\Temp\imyfone-anyto_setup.exe" C:\Users\admin\AppData\Local\Temp\imyfone-anyto_setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
imyfone-anyto_setup.exe
Version:
4.4.0.1
Modules
Images
c:\users\admin\appdata\local\temp\imyfone-anyto_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4892taskkill /f /t /im adb.exeC:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
5 228
Read events
5 210
Write events
18
Delete events
0

Modification events

(PID) Process:(4164) imyfone-anyto_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\iMyfone\iMyfoneDown
Operation:writeName:GUID
Value:
A508FF7B-CCFA-4462-82F5-371B1B2F5B98
(PID) Process:(7420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7420) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7632) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7632) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7632) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7792) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7792) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7792) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
315
Suspicious files
520
Text files
2 383
Unknown types
0

Dropped files

PID
Process
Filename
Type
7632BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9482a17f-0919-4077-ae42-8066ea54397c.down_data —
MD5:—
SHA256:—
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\imyfone-download.exe.tmp —
MD5:—
SHA256:—
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\imyfone-download.exe —
MD5:—
SHA256:—
7632BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9482a17f-0919-4077-ae42-8066ea54397c.57385162-6fc3-4865-b862-36705339bf23.down_metabinary
MD5:53EC03C5FC18B73863CB32403AAEC208
SHA256:41E212DF64E5386CE721AA07ADA7CAA70BD3B81C880380A6BC717759B1C257D9
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\language\English\pr_1.pngimage
MD5:9B406C3D0216355E79820184E8CC013E
SHA256:33810207AE81CE8DEC32BEFB80E7E300B5259A97D9B9074D6327302224457D5A
7632BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:9B8E9161B7C50CFB9EA1903C8870BAE0
SHA256:6FF3FB8FAD7E6EC5B20C0C343B1A6C9321C1C550394F7ED7FBA61D82C79BB054
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\language\productInfo.initext
MD5:AE64C8B1A974EE5AC3D89774ED574DCC
SHA256:153F3F60248ED376B16D8D5DFA91AB95DD1BEDDBA4E1E44F58C57C8492A67310
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\language\English\pr_4.pngimage
MD5:11BF8ED7FE27A2C84AFD68CA22A3A98F
SHA256:7668DD995631D8D2050C04E1F2B725DA06A2552155535702753C2AE2FC6EA03E
4164imyfone-anyto_setup.exeC:\Program Files (x86)\imyfone_down\imyfone-anyto_setup\language\English\pr_3.pngimage
MD5:27ACF1A6A72495EF049297D6BF8E2C8D
SHA256:7C3F7E02DCF03385F0E10B04A4B1AC04D062EF3305C02EE5175D94BC6BCE70E9
7632BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:020DC83877019BE16C75BF4E685DDC7A
SHA256:2B1C5231182E56470983E39BFC85F67F8E1FFB0F99AF501BA598900B040FEC5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
40
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.24:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4300
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7632
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.24:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4164
imyfone-anyto_setup.exe
142.250.185.78:443
www.google-analytics.com
GOOGLE
US
whitelisted
4164
imyfone-anyto_setup.exe
18.66.102.61:443
download-new.imyfone.com
—
US
whitelisted
4164
imyfone-anyto_setup.exe
47.254.4.210:443
apipdm.imyfone.club
Alibaba US Technology Co., Ltd.
US
suspicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.24
  • 2.16.164.106
  • 2.16.164.81
  • 2.16.164.72
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.130
  • 40.126.32.72
  • 40.126.32.133
  • 20.190.160.131
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
download-new.imyfone.com
  • 18.66.102.61
  • 18.66.102.114
  • 18.66.102.32
  • 18.66.102.67
whitelisted
www.google-analytics.com
  • 142.250.185.78
  • 216.58.206.46
whitelisted
apipdm.imyfone.club
  • 47.254.4.210
unknown
download.imyfone.com
  • 65.9.66.119
  • 65.9.66.97
  • 65.9.66.61
  • 65.9.66.89
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
imyfone-anyto_setup.exe