File name:

After_Effects_Set-Up (1).exe

Full analysis: https://app.any.run/tasks/f6092ddb-b183-4fa9-b938-e6b7c317b255
Verdict: Malicious activity
Analysis date: May 17, 2025, 06:00:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

FA1BEBA48EF8C786B2A4F38ADC3B4483

SHA1:

19745869810CD99CAC44709BD42C2B0E25FEC622

SHA256:

DDAF989461BAA7EEB0D9787A2A072722ABC3F51E53B1B607AB1BA7B16F49F378

SSDEEP:

98304:ehrrrAZbJJcNChltm1kO0U2qcJtWYhcU91jTJ7bWu7Cw28/H/EDOjdmRFva3opuq:7Qn3xQj3s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Reads Microsoft Outlook installation path

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Reads Internet Explorer settings

      • After_Effects_Set-Up (1).exe (PID: 6436)

  • INFO

    • Reads the computer name

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Reads the software policy settings

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Process checks computer location settings

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Reads the machine GUID from the registry

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • The sample compiled with english language support

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Create files in a temporary directory

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • UPX packer has been detected

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Manual execution by a user

      • firefox.exe (PID: 7264)
      • mspaint.exe (PID: 6268)
      • WINWORD.EXE (PID: 4448)

    • Checks supported languages

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Checks proxy server information

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Process checks whether UAC notifications are on

      • After_Effects_Set-Up (1).exe (PID: 6436)

    • Application launched itself

      • firefox.exe (PID: 7252)
      • firefox.exe (PID: 7264)

    • Creates files or folders in the user directory

      • After_Effects_Set-Up (1).exe (PID: 6436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:10:30 03:14:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.23
CodeSize: 2072576
InitializedDataSize: 45056
UninitializedDataSize: 3284992
EntryPoint: 0x51cb70
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.3.5.13
ProductVersionNumber: 5.3.5.13
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Inc.
FileDescription: Adobe Installer
FileVersion: 5.3.5.13
InternalName: Adobe Installer
LegalCopyright: © 2015-2020 Adobe. All rights reserved.
OriginalFileName: Adobe Installer
ProductName: Adobe Installer
ProductVersion: 5.3.5.13
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start after_effects_set-up (1).exe sppextcomobj.exe no specs slui.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winword.exe ai.exe no specs mspaint.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4936 -childID 3 -isForBrowser -prefsHandle 4972 -prefMapHandle 4836 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75eda7c4-bc30-4688-bbeb-8150bd87f547} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb3c46b150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4276 -childID 2 -isForBrowser -prefsHandle 4216 -prefMapHandle 4224 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9ae6a9c-5c66-4e26-8b13-b923693898b2} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb3b199a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4152"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 6 -isForBrowser -prefsHandle 2652 -prefMapHandle 5704 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43ae5951-196f-4165-acf2-9d4c4fddfae2} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb3b982850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
4448"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\pointrental.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4452"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2660 -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 2804 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8a7d38e-ce2d-4c32-bf3c-671a4979c0f9} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb38c44f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
6268"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\stringshare.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6436"C:\Users\admin\AppData\Local\Temp\After_Effects_Set-Up (1).exe" C:\Users\admin\AppData\Local\Temp\After_Effects_Set-Up (1).exe
explorer.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Installer
Version:
5.3.5.13
Modules
Images
c:\users\admin\appdata\local\temp\after_effects_set-up (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6480"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4988 -childID 4 -isForBrowser -prefsHandle 4984 -prefMapHandle 4980 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96a6da61-97ec-4845-bb15-b8918e76ca29} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb3c46b690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6560"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1908 -parentBuildID 20240213221259 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7a62c04-c1b1-4518-8ec1-975e157c4b79} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1fb33eeee10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
Total events
25 765
Read events
25 509
Write events
240
Delete events
16

Modification events

(PID) Process:(6436) After_Effects_Set-Up (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6436) After_Effects_Set-Up (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6436) After_Effects_Set-Up (1).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7252) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\4448
Operation:writeName:0
Value:
0B0E105C4D9C8ABD82D641A01766B421999CDB230046D7C1F5A391DEF1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511E022D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(4448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
Executable files
1
Suspicious files
205
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\js\mainController.jsbinary
MD5:51BDCC0E7D53C59FF20FF2F6E276E321
SHA256:EC5B0CEDE51F5FD48C341CD27D42433BB9A2ADB04836433FEE5A90B101E4B1B2
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\lib\IE8\jquery.min.jsbinary
MD5:E1288116312E4728F98923C79B034B67
SHA256:BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\CreativeCloud\ACC\WAM.logtext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\clean.csstext
MD5:4F3364AF3E396F92A8826532BFB1A7E5
SHA256:45B9B77499356527E9047256DB96A542A720BF075D67E9F6BA55D51FD562339E
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\js\overlayController.jsbinary
MD5:B610650C4D826B14C225CFBECA89B8C1
SHA256:79D00458B49A02ACEE141B53DCF026AA1302AB6B48A745B57E1215BD3B20501C
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\js\main.jsbinary
MD5:A2ECC3BBA3A5033720DD046CC6CF64D3
SHA256:FC1BBA3A598AF6605A402AD2552CD8D7605E51A019AF119F25F30DFBD67E63C0
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\main.csstext
MD5:10CB515B5EAD87D1548F1C7DB3FB29FE
SHA256:B45286705F1A5F055C1039CD3DFDE70B85194368E6EB492C7B725E8261F5379B
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\lib\jquery.custom-scrollbar.min.jsbinary
MD5:AB3ADF4AFF09A1C562A29DB05795C8AB
SHA256:D05E193674C6FC31DE0503CBC0B152600F22689AD7AD72ADB35FCC7C25D4B01B
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Adobe\OOBE\temp_ins_lbs_widtext
MD5:652CE08E86D65DD0518DB56EF23ABAAE
SHA256:467568BA3DCC144D1FC8359B40516595A71932BC77EC0C5128520339749F8FFF
6436After_Effects_Set-Up (1).exeC:\Users\admin\AppData\Local\Temp\{90187CB1-7C50-4D91-8303-13087255FF1B}\images\cancelButton2x.pngimage
MD5:1B46E3CD914D5E0A8647EB648E3969CF
SHA256:4D9AEA82FA1E55F787FCACB17C893A7EA730EF44BF1E6696F284629B92B210F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
111
DNS requests
144
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6436
After_Effects_Set-Up (1).exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEALg45daKT25OnNobTFoqPw%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7252
firefox.exe
POST
200
184.24.77.46:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7252
firefox.exe
POST
200
184.24.77.46:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
7252
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7252
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7252
firefox.exe
POST
200
184.24.77.46:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7252
firefox.exe
POST
200
184.24.77.46:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6436
After_Effects_Set-Up (1).exe
34.213.253.53:443
na1e-acc.services.adobe.com
AMAZON-02
US
whitelisted
6436
After_Effects_Set-Up (1).exe
34.250.67.152:443
cc-api-data.adobe.io
AMAZON-02
IE
whitelisted
—
—
34.250.67.152:443
cc-api-data.adobe.io
AMAZON-02
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6436
After_Effects_Set-Up (1).exe
172.66.0.163:443
ims-prod07.adobelogin.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.30
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
na1e-acc.services.adobe.com
  • 34.213.253.53
  • 52.26.37.169
  • 54.68.210.54
whitelisted
cc-api-data.adobe.io
  • 34.250.67.152
  • 54.195.71.107
  • 54.194.243.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ims-prod07.adobelogin.com
  • 172.66.0.163
  • 162.159.140.165
whitelisted
cdn-ffc.oobesaas.adobe.com
  • 18.245.60.41
  • 18.245.60.45
  • 18.245.60.55
  • 18.245.60.126
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.22
  • 40.126.32.76
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
After_Effects_Set-Up (1).exe