File name:

Core-Temp-setup-v1.18.1.0.exe

Full analysis: https://app.any.run/tasks/7b4e3071-260b-415a-bf12-986497259324
Verdict: Malicious activity
Analysis date: March 24, 2025, 08:20:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
alsysio64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

176642114EE7A82E0486BF5FAC5777C0

SHA1:

F4329A1AFC37F143BA1D39D9670CA4B1ACD61C23

SHA256:

CA7D1365E934B3BD122AB8B0DBD24EF5E0C52471CFCA15921555FC6B244E9AB6

SSDEEP:

49152:TwE0bqq2LkelPNf4qz2ZBQq9RuNkDtz7OU4SD3e9yDZocZIOtAcAmWoz4IY3WO+y:z0bBWTJ4VBL9RBtzBO9yGgMu40X9SFuu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • Core Temp.exe (PID: 1272)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)

    • Executable content was dropped or overwritten

      • Core-Temp-setup-v1.18.1.0.exe (PID: 7696)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)
      • Core Temp.exe (PID: 1272)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7524)

    • Drops a system driver (possible attempt to evade defenses)

      • Core Temp.exe (PID: 1272)

    • Start notepad (likely ransomware note)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)

    • Creates file in the systems drive root

      • Core Temp.exe (PID: 1272)

    • Executes application which crashes

      • Core Temp.exe (PID: 1272)

  • INFO

    • Reads the computer name

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)
      • Core Temp.exe (PID: 8040)

    • Create files in a temporary directory

      • Core-Temp-setup-v1.18.1.0.exe (PID: 7524)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7696)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)
      • Core Temp.exe (PID: 1272)
      • Core Temp.exe (PID: 2344)

    • Checks supported languages

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7696)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7524)

    • Process checks computer location settings

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)

    • Detects InnoSetup installer (YARA)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7696)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)

    • Compiled with Borland Delphi (YARA)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7552)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 7696)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)

    • Creates files in the program directory

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)
      • Core Temp.exe (PID: 1272)

    • The sample compiled with english language support

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)
      • Core Temp.exe (PID: 1272)

    • Creates a software uninstall entry

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 7720)

    • Manual execution by a user

      • Core Temp.exe (PID: 8040)
      • Core Temp.exe (PID: 7584)
      • Core Temp.exe (PID: 2344)
      • Core Temp.exe (PID: 6620)
      • Core Temp.exe (PID: 8132)
      • Core Temp.exe (PID: 5556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.18.1.0
ProductVersionNumber: 1.18.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ALCPU
FileDescription: Core Temp Setup
FileVersion: 1.18.1.0
LegalCopyright:
ProductName: Core Temp
ProductVersion: 1.18.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
16
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp no specs core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp sppextcomobj.exe no specs slui.exe notepad.exe no specs THREAT core temp.exe werfault.exe no specs core temp.exe no specs core temp.exe core temp.exe no specs core temp.exe slui.exe no specs core temp.exe no specs core temp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1272"C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
3221225477
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2344"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\ucrtbase.dll
3364C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5556"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe—explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
CPU temperature and system information utility
Exit code:
3221226540
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
5680"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txtC:\Windows\SysWOW64\notepad.exe—Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
6620"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
7212C:\WINDOWS\system32\WerFault.exe -u -p 1272 -s 2144C:\Windows\System32\WerFault.exe—Core Temp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
7524"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7552"C:\Users\admin\AppData\Local\Temp\is-HCTE1.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$B0162,868100,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\is-HCTE1.tmp\Core-Temp-setup-v1.18.1.0.tmp—Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hcte1.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7584"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe—explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
CPU temperature and system information utility
Exit code:
3221226540
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
Total events
10 059
Read events
9 956
Write events
96
Delete events
7

Modification events

(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (u)
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Core Temp
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Core Temp\
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Core Temp
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon,goodgamesempire,languagepacks
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
coretempgadget,remoteserver
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Language
Value:
en
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayName
Value:
Core Temp 1.18.1
(PID) Process:(7720) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Core Temp\Core Temp.exe
Executable files
8
Suspicious files
8
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-7UQBR.tmptext
MD5:932B5FB4B60BBA2DBF7D178518C69670
SHA256:37C7CC1DEE0A655060E37333B4D99E697DAD5C197FFDB30BF136E1412C5D70D8
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-G0I62.tmpexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Changes.txttext
MD5:0FF2E6869879C98DC6144F3384DB16A0
SHA256:87E330164B239690BA6E3B99F16768CEE7C457225C2971C7C3E52C0E21F95332
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\ab-AB.lngxml
MD5:2C69729BAFE1F9B6E5FA4BBCEB157F97
SHA256:9AA957B6815486B0009CD72244C06DE6ADB0C6A4435BA17502855BFA210CF319
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\License.txttext
MD5:932B5FB4B60BBA2DBF7D178518C69670
SHA256:37C7CC1DEE0A655060E37333B4D99E697DAD5C197FFDB30BF136E1412C5D70D8
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Readme.txttext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-QS8IM.tmptext
MD5:0FF2E6869879C98DC6144F3384DB16A0
SHA256:87E330164B239690BA6E3B99F16768CEE7C457225C2971C7C3E52C0E21F95332
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Core Temp.exeexecutable
MD5:005727AA95C9F4899EA7673B114D91DE
SHA256:26259A6F290A799EEB1C7C9B311E528C77E458582F9396D4DFC1C69DD2AD6891
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\ca.lngxml
MD5:CAB3C7DAECF34248C80265D8110362A2
SHA256:59CC53C555FE7E63BA8829CD028829DC8DD74427992925C1E19E86E20207331B
7720Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\is-LIVIL.tmpxml
MD5:4EA78FDD1EFD2D4756BC1E4F16B3DF00
SHA256:B88748DB05E055D523562DAFC6A8782B15DD95DA433EFB159F92F13D4127D708
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
41
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3332
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.64:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3332
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.159.131:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3216
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.143
  • 23.48.23.180
  • 23.48.23.173
  • 23.48.23.167
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.141
  • 23.48.23.176
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.221
  • 2.23.227.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core-Temp-setup-v1.18.1.0.exe