File name:

Core-Temp-setup-v1.20.0.145.exe

Full analysis: https://app.any.run/tasks/e6b1c54d-471c-4734-b4b8-9d82a24f123d
Verdict: Malicious activity
Analysis date: April 22, 2026, 06:24:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

47EFD9A481DAC895EA5995208D577967

SHA1:

4F89468D0DCA960E3E9E80FB42D20D104886B45A

SHA256:

FA73992B001C54B64384776BD08B5D7C15C1D68423C42F325BE129FA888E66D7

SSDEEP:

49152:iwE03M6z4qG2SRQ1IAAH6ympUfhHeb0F5GeyZgiWHzg0y56Uo0HRSAqPRSeOYsMe:g0c6UqpSXHfmKfteb0zGeDZk0y5To0x7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2328)
      • Core Temp.exe (PID: 2132)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

    • Reads the Windows owner or organization settings

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)

    • Drops a system driver (possible attempt to evade defenses)

      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

  • INFO

    • Checks supported languages

      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

    • Reads the computer name

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

    • Process checks computer location settings

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)

    • Reads security settings of Internet Explorer

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)

    • Create files in a temporary directory

      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

    • Detects InnoSetup installer (YARA)

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)

    • Compiled with Borland Delphi (YARA)

      • Core-Temp-setup-v1.20.0.145.exe (PID: 7804)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7484)
      • Core-Temp-setup-v1.20.0.145.exe (PID: 2692)
      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)

    • The sample compiled with english language support

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)
      • Core Temp.exe (PID: 7936)
      • Core Temp.exe (PID: 2132)

    • Creates a software uninstall entry

      • Core-Temp-setup-v1.20.0.145.tmp (PID: 7712)

    • Manual execution by a user

      • Core Temp.exe (PID: 2132)
      • Core Temp.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.20.0.145
ProductVersionNumber: 1.20.0.145
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ALCPU
FileDescription: Core Temp Setup
FileVersion: 1.20.0.145
LegalCopyright:
ProductName: Core Temp
ProductVersion: 1.20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
7
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start core-temp-setup-v1.20.0.145.exe core-temp-setup-v1.20.0.145.tmp no specs core-temp-setup-v1.20.0.145.exe core-temp-setup-v1.20.0.145.tmp core temp.exe core temp.exe no specs core temp.exe

Process information

PID
CMD
Path
Indicators
Parent process
2132"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.20.0.145
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\powrprof.dll
2328"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe—explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
CPU temperature and system information utility
Exit code:
3221226540
Version:
1.20.0.145
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
2692"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe" /SPAWNWND=$D020E /NOTIFYWND=$C0300 C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe
Core-Temp-setup-v1.20.0.145.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
Core Temp Setup
Exit code:
0
Version:
1.20.0.145
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.20.0.145.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7484"C:\Users\admin\AppData\Local\Temp\is-23LER.tmp\Core-Temp-setup-v1.20.0.145.tmp" /SL5="$C0300,1267592,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe" C:\Users\admin\AppData\Local\Temp\is-23LER.tmp\Core-Temp-setup-v1.20.0.145.tmp—Core-Temp-setup-v1.20.0.145.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-23ler.tmp\core-temp-setup-v1.20.0.145.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7712"C:\Users\admin\AppData\Local\Temp\is-35A7L.tmp\Core-Temp-setup-v1.20.0.145.tmp" /SL5="$6022C,1267592,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe" /SPAWNWND=$D020E /NOTIFYWND=$C0300 C:\Users\admin\AppData\Local\Temp\is-35A7L.tmp\Core-Temp-setup-v1.20.0.145.tmp
Core-Temp-setup-v1.20.0.145.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-35a7l.tmp\core-temp-setup-v1.20.0.145.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7804"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe" C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.20.0.145.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
Core Temp Setup
Exit code:
0
Version:
1.20.0.145
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.20.0.145.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7936"C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe
Core-Temp-setup-v1.20.0.145.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.20.0.145
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
846
Read events
821
Write events
25
Delete events
0

Modification events

(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (u)
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Core Temp
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Core Temp\
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Core Temp
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon,languagepacks
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
coretempgadget,remoteserver
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Language
Value:
en
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayName
Value:
Core Temp 1.20
(PID) Process:(7712) Core-Temp-setup-v1.20.0.145.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Core Temp\Core Temp.exe
Executable files
9
Suspicious files
4
Text files
62
Unknown types
5

Dropped files

PID
Process
Filename
Type
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\is-8Q3L8.tmpexecutable
MD5:9D7A45AA0D5471F958A6D9FD5FE5514D
SHA256:CF5AEF577119F177D49D2869D9793F57E90DFEB015D8B93662BFB9D5E81270F4
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\is-OEVG6.tmpexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
2692Core-Temp-setup-v1.20.0.145.exeC:\Users\admin\AppData\Local\Temp\is-35A7L.tmp\Core-Temp-setup-v1.20.0.145.tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\is-MHD3A.tmptext
MD5:843433BCC9FD1326F5C5FAABA1DB7FC3
SHA256:0472B89FD19FBF8EF109975B6777D85F039979CF57380FCBB2804346310C32B6
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\Changes.txttext
MD5:843433BCC9FD1326F5C5FAABA1DB7FC3
SHA256:0472B89FD19FBF8EF109975B6777D85F039979CF57380FCBB2804346310C32B6
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\is-OEPA4.tmptext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
7712Core-Temp-setup-v1.20.0.145.tmpC:\Users\admin\AppData\Local\Temp\is-0BIV0.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\unins000.exeexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\Core Temp.exeexecutable
MD5:9D7A45AA0D5471F958A6D9FD5FE5514D
SHA256:CF5AEF577119F177D49D2869D9793F57E90DFEB015D8B93662BFB9D5E81270F4
7712Core-Temp-setup-v1.20.0.145.tmpC:\Program Files\Core Temp\Readme.txttext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
26
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
959 b
whitelisted
3352
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
6796
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6796
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
6796
SIHClient.exe
GET
200
74.178.76.128:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
6796
SIHClient.exe
GET
304
74.178.76.128:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
3352
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5316
svchost.exe
POST
400
20.190.159.75:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
3352
svchost.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5276
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
3352
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
128.24.231.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.204.141:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3428
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
activation-v2.sls.microsoft.com
  • 128.24.231.64
whitelisted
google.com
  • 142.251.110.139
  • 142.251.110.138
  • 142.251.110.101
  • 142.251.110.113
  • 142.251.110.100
  • 142.251.110.102
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.158
  • 2.16.204.159
  • 2.16.204.135
  • 2.16.204.150
  • 2.16.204.137
  • 2.16.204.160
  • 2.16.204.138
  • 2.16.204.136
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.128
  • 20.190.159.71
  • 20.190.159.2
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
3352
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core-Temp-setup-v1.20.0.145.exe