File name:

Core-Temp-setup-v1.18.1.0.exe

Full analysis: https://app.any.run/tasks/ab6a36b8-c82c-4aa8-b0ab-ce7b2a1d57bb
Verdict: Malicious activity
Analysis date: April 28, 2025, 09:17:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
alsysio64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

176642114EE7A82E0486BF5FAC5777C0

SHA1:

F4329A1AFC37F143BA1D39D9670CA4B1ACD61C23

SHA256:

CA7D1365E934B3BD122AB8B0DBD24EF5E0C52471CFCA15921555FC6B244E9AB6

SSDEEP:

49152:TwE0bqq2LkelPNf4qz2ZBQq9RuNkDtz7OU4SD3e9yDZocZIOtAcAmWoz4IY3WO+y:z0bBWTJ4VBL9RBtzBO9yGgMu40X9SFuu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • Core Temp.exe (PID: 2384)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)

    • Executable content was dropped or overwritten

      • Core-Temp-setup-v1.18.1.0.exe (PID: 2284)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 6988)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)
      • Core Temp.exe (PID: 2384)

    • Reads the Windows owner or organization settings

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • Start notepad (likely ransomware note)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)

    • Drops a system driver (possible attempt to evade defenses)

      • Core Temp.exe (PID: 2384)

  • INFO

    • Create files in a temporary directory

      • Core-Temp-setup-v1.18.1.0.exe (PID: 2284)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 6988)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)
      • Core Temp.exe (PID: 2384)

    • Checks supported languages

      • Core-Temp-setup-v1.18.1.0.exe (PID: 2284)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 6988)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)
      • Core Temp.exe (PID: 2384)

    • Reads the computer name

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • Process checks computer location settings

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)

    • Compiled with Borland Delphi (YARA)

      • Core-Temp-setup-v1.18.1.0.exe (PID: 6988)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 2284)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • Detects InnoSetup installer (YARA)

      • Core-Temp-setup-v1.18.1.0.exe (PID: 2284)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4996)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 6988)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • Creates files in the program directory

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • Creates a software uninstall entry

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)

    • The sample compiled with english language support

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 4628)
      • Core Temp.exe (PID: 2384)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 5228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.18.1.0
ProductVersionNumber: 1.18.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ALCPU
FileDescription: Core Temp Setup
FileVersion: 1.18.1.0
LegalCopyright:
ProductName: Core Temp
ProductVersion: 1.18.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
8
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp no specs core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp sppextcomobj.exe no specs slui.exe no specs notepad.exe no specs THREAT core temp.exe

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\downloads\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2384"C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\gdi32full.dll
4628"C:\Users\admin\AppData\Local\Temp\is-8ETVH.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$5025C,868100,121344,C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$3025E /NOTIFYWND=$50262 C:\Users\admin\AppData\Local\Temp\is-8ETVH.tmp\Core-Temp-setup-v1.18.1.0.tmp
Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8etvh.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4996"C:\Users\admin\AppData\Local\Temp\is-CGU7V.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$50262,868100,121344,C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\is-CGU7V.tmp\Core-Temp-setup-v1.18.1.0.tmp—Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cgu7v.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5228"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txtC:\Windows\SysWOW64\notepad.exe—Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
5352"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6044C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6988"C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$3025E /NOTIFYWND=$50262 C:\Users\admin\Downloads\Core-Temp-setup-v1.18.1.0.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\downloads\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
1 242
Read events
1 216
Write events
26
Delete events
0

Modification events

(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (u)
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Core Temp
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Core Temp\
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Core Temp
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon,languagepacks
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
goodgamesempire,coretempgadget,remoteserver
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Language
Value:
en
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayName
Value:
Core Temp 1.18.1
(PID) Process:(4628) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Core Temp\Core Temp.exe
Executable files
8
Suspicious files
4
Text files
69
Unknown types
0

Dropped files

PID
Process
Filename
Type
2284Core-Temp-setup-v1.18.1.0.exeC:\Users\admin\AppData\Local\Temp\is-CGU7V.tmp\Core-Temp-setup-v1.18.1.0.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
6988Core-Temp-setup-v1.18.1.0.exeC:\Users\admin\AppData\Local\Temp\is-8ETVH.tmp\Core-Temp-setup-v1.18.1.0.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\ab-AB.lngxml
MD5:2C69729BAFE1F9B6E5FA4BBCEB157F97
SHA256:9AA957B6815486B0009CD72244C06DE6ADB0C6A4435BA17502855BFA210CF319
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\is-T5VAS.tmpxml
MD5:617A5FEBD1666CA193F4F1A9D68141C3
SHA256:1C2EF08100E6ABE030648AA79481A09DAA116FA2C2576CA6FEC8BEA859FBC978
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\unins000.exeexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-IMK89.tmpexecutable
MD5:005727AA95C9F4899EA7673B114D91DE
SHA256:26259A6F290A799EEB1C7C9B311E528C77E458582F9396D4DFC1C69DD2AD6891
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-K28Q4.tmpexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Readme.txttext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
4628Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\bg-BG.lngxml
MD5:4EA78FDD1EFD2D4756BC1E4F16B3DF00
SHA256:B88748DB05E055D523562DAFC6A8782B15DD95DA433EFB159F92F13D4127D708
4628Core-Temp-setup-v1.18.1.0.tmpC:\Users\admin\AppData\Local\Temp\is-HSONH.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.5:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.5:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.5
  • 23.216.77.15
  • 23.216.77.38
  • 23.216.77.39
  • 23.216.77.19
  • 23.216.77.7
  • 23.216.77.37
  • 23.216.77.18
  • 23.216.77.22
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.131
  • 20.190.159.23
  • 40.126.31.0
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.1
  • 40.126.31.71
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core-Temp-setup-v1.18.1.0.exe