File name:

ll.exe

Full analysis: https://app.any.run/tasks/5ceba2e3-4565-43cd-a55d-47ed611f9f42
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 14, 2024, 01:11:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
arch-doc
arch-exec
vmprotect
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

56639CE27CC7D7EB971C0CCBD0176C88

SHA1:

1146FA062B6E794220B785D25B74D87A658BBC4B

SHA256:

248210AB5672DABF88D101D810BD3E8A9050DF0C2D026A19F92576AEBFEB23F4

SSDEEP:

6144:GcQEwhWfK91Iho2C+8DbLbTz2FpOAp6pdb7xSv9qCU1N:G9EIkm2CF3z2FpOh5Sv98

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • ll.exe (PID: 6696)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • ll.exe (PID: 6696)

    • Reads security settings of Internet Explorer

      • ll.exe (PID: 6696)

    • Creates/Modifies COM task schedule object

      • ll.exe (PID: 6696)

    • Process drops legitimate windows executable

      • ll.exe (PID: 6696)

    • The process drops C-runtime libraries

      • ll.exe (PID: 6696)

    • Checks Windows Trust Settings

      • ll.exe (PID: 6696)

    • Process requests binary or script from the Internet

      • ll.exe (PID: 6696)

    • Executable content was dropped or overwritten

      • ll.exe (PID: 6696)

    • Potential Corporate Privacy Violation

      • ll.exe (PID: 6696)

    • Creates a software uninstall entry

      • ll.exe (PID: 6696)

    • The process checks if it is being run in the virtual environment

      • RobloxPlayerBeta.exe (PID: 6220)

  • INFO

    • Creates files or folders in the user directory

      • ll.exe (PID: 6696)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 6232)

    • Manual execution by a user

      • notepad.exe (PID: 6232)
      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 5168)
      • OpenWith.exe (PID: 5232)
      • OpenWith.exe (PID: 7112)
      • OpenWith.exe (PID: 5592)
      • OpenWith.exe (PID: 2360)
      • OpenWith.exe (PID: 6464)
      • OpenWith.exe (PID: 6592)
      • OpenWith.exe (PID: 6720)
      • OpenWith.exe (PID: 6872)
      • OpenWith.exe (PID: 6244)
      • OpenWith.exe (PID: 2132)
      • OpenWith.exe (PID: 5976)
      • OpenWith.exe (PID: 4076)
      • OpenWith.exe (PID: 6556)
      • OpenWith.exe (PID: 6900)
      • OpenWith.exe (PID: 4144)
      • OpenWith.exe (PID: 6416)
      • OpenWith.exe (PID: 1248)
      • OpenWith.exe (PID: 1768)
      • RobloxPlayerBeta.exe (PID: 6220)

    • Process checks computer location settings

      • ll.exe (PID: 6696)

    • Create files in a temporary directory

      • ll.exe (PID: 6696)

    • Checks supported languages

      • ll.exe (PID: 6696)
      • identity_helper.exe (PID: 3568)

    • Checks proxy server information

      • ll.exe (PID: 6696)

    • Reads the software policy settings

      • ll.exe (PID: 6696)

    • Reads the machine GUID from the registry

      • ll.exe (PID: 6696)

    • Reads the computer name

      • ll.exe (PID: 6696)
      • identity_helper.exe (PID: 3568)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 6592)
      • OpenWith.exe (PID: 5168)
      • OpenWith.exe (PID: 5232)
      • OpenWith.exe (PID: 6720)
      • OpenWith.exe (PID: 6872)
      • OpenWith.exe (PID: 2360)
      • OpenWith.exe (PID: 5592)
      • OpenWith.exe (PID: 7112)
      • OpenWith.exe (PID: 6464)
      • OpenWith.exe (PID: 2132)
      • OpenWith.exe (PID: 4144)
      • OpenWith.exe (PID: 6416)
      • OpenWith.exe (PID: 1248)
      • OpenWith.exe (PID: 5976)
      • OpenWith.exe (PID: 4076)
      • OpenWith.exe (PID: 6900)
      • OpenWith.exe (PID: 6556)
      • OpenWith.exe (PID: 6244)
      • OpenWith.exe (PID: 1768)

    • Reads Environment values

      • identity_helper.exe (PID: 3568)

    • VMProtect protector has been detected

      • RobloxPlayerBeta.exe (PID: 6220)

    • Application launched itself

      • msedge.exe (PID: 4376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:08:19 15:44:24+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 252928
InitializedDataSize: 547840
UninitializedDataSize: -
EntryPoint: 0x36850
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.0.0.4
ProductVersionNumber: 1.6.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: ECS:R Bootstrapper
FileVersion: 5, 0, 0, 004
LegalCopyright: (C) 2012 Roblox Corporation. All rights reserved.
OriginalFileName: Roblox.exe
ProductName: ECS:R Bootstrapper
ProductVersion: 1, 6, 0, 0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
58
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ll.exe notepad.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs msedge.exe msedge.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs THREAT robloxplayerbeta.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2692 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5632 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1248"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\CompositFullAtlasOverlayTexture.meshC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1576"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5660 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1576"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6392 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1768"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\headO.meshC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2132"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\humanoidSoundNew.rbxmC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2360"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\humanoidAnimateLocalKeyframe.rbxmC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2364"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2384 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2620"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6028 --field-trial-handle=2380,i,1422684755558439767,14138396093508228071,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
18 467
Read events
18 367
Write events
86
Delete events
14

Modification events

(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:writeName:CPath
Value:
C:\Users\admin\AppData\LocalLow\rbxcsettings.rbx
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:delete valueName:curStudioVer
Value:
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:delete valueName:curStudioUrl
Value:
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65D12F6E-CAE5-4AF4-81F2-9BBD441AB249}
Operation:writeName:AppName
Value:
RobloxPlayerLauncher.exe
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65D12F6E-CAE5-4AF4-81F2-9BBD441AB249}
Operation:writeName:Policy
Value:
3
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65D12F6E-CAE5-4AF4-81F2-9BBD441AB249}
Operation:writeName:AppPath
Value:
C:\Users\admin\AppData\Local\ECSR\Versions\ECSRClient230824\
(PID) Process:(6696) ll.exeKey:HKEY_CURRENT_USER\SOFTWARE\ROBLOX Corporation\Roblox
Operation:writeName:curQTStudioVer
Value:
Executable files
19
Suspicious files
566
Text files
538
Unknown types
52

Dropped files

PID
Process
Filename
Type
6696ll.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\WindowsBootstrapperSettings[1].jsonbinary
MD5:A84B13E2C16BF4F34AE2B8BAF90B88D7
SHA256:2B5067D9D65EF10CAF355D42E45B72A2ACD557FD9BC5A6474B38E5FCAB3E0195
6696ll.exeC:\Users\admin\AppData\Local\Temp\RBX-EEA1371F.tmpcompressed
MD5:04703DC98F385BED4A5C71C1C2C50032
SHA256:74971652DCA12F48DAE7678FACF6E1C5538D1D237CE7535FA41697C0DBD751DD
6696ll.exeC:\Users\admin\AppData\Local\ECSR\Versions\ECSRClient230824\RobloxPlayerLauncher.exeexecutable
MD5:56639CE27CC7D7EB971C0CCBD0176C88
SHA256:248210AB5672DABF88D101D810BD3E8A9050DF0C2D026A19F92576AEBFEB23F4
6696ll.exeC:\Users\admin\AppData\Local\ECSR\Versions\ECSRClient230824\NPRobloxProxy.dllexecutable
MD5:BFAF9EC4443B5F4DC3A4D958F3C7286A
SHA256:6611207695BA5D48F1FDD42501DD448B59BF830684BD16A00C91FD75AB9EA1EE
6696ll.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\GetCurrentClientVersionUpload[1].txttext
MD5:E51FC90B54F900EEC9B29CBC662299D6
SHA256:E8CD0BFC18925596BABB0B07ABA79D57647A5DD20367270C74176730530790E8
6696ll.exeC:\Users\admin\AppData\LocalLow\rbxcsettings.rbxtext
MD5:818B469A34FD6BF9FF2C4FA463410A55
SHA256:2E81AD6E973D1B9C66E30393EFFCBE0302E15B54F183E149C1047799E88E0B1E
6696ll.exeC:\Users\admin\AppData\Local\ECSR\Downloads\1daf4eccbd4abeecompressed
MD5:04703DC98F385BED4A5C71C1C2C50032
SHA256:74971652DCA12F48DAE7678FACF6E1C5538D1D237CE7535FA41697C0DBD751DD
6696ll.exeC:\Users\admin\AppData\Local\Temp\RBX-217164C1.tmpcompressed
MD5:0243BB4550B79C97EA553AAF386B4055
SHA256:1F5B70B45AFA9FEBE00123AB795FFE3FF7395324871570B12AFE4C94A5F31E04
6696ll.exeC:\Users\admin\AppData\Local\ECSR\Downloads\1daf4eccbd0d5a4compressed
MD5:0243BB4550B79C97EA553AAF386B4055
SHA256:1F5B70B45AFA9FEBE00123AB795FFE3FF7395324871570B12AFE4C94A5F31E04
6696ll.exeC:\Users\admin\AppData\Local\ECSR\Versions\ECSRClient230824\RobloxProxy.dllexecutable
MD5:BECBFD4C7362015E7A2C2E7E24EED94A
SHA256:FED04851FF547EFDDDED3B710A9A3A097E6125B4E8826F9B43EC182494421EAB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
91
DNS requests
57
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6696
ll.exe
GET
200
188.114.97.3:80
http://ecsr.io/BootstrapperDeployment/ECSRClient230824-content-music.zip
unknown
—
—
whitelisted
6696
ll.exe
GET
200
188.114.97.3:80
http://ecsr.io/BootstrapperDeployment/ECSRClient230824-redist.zip
unknown
—
—
whitelisted
6696
ll.exe
GET
200
188.114.97.3:80
http://ecsr.io/BootstrapperDeployment/ECSRClient230824-content-textures3.zip
unknown
—
—
whitelisted
6696
ll.exe
GET
200
188.114.97.3:80
http://ecsr.io/BootstrapperDeployment/ECSRClient230824-content-terrain.zip
unknown
—
—
whitelisted
—
—
GET
200
188.114.97.3:443
https://ecsr.io/apisite/versioncompatibility/GetCurrentClientVersionUpload/?apiKey=76e5a40c-3ae1-4028-9f10-7c62520bd94b&binaryType=WindowsPlayer
unknown
—
—
—
5488
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3524
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3524
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.209.185:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6696
ll.exe
188.114.97.3:443
ecsr.io
CLOUDFLARENET
NL
unknown
6944
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3524
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.187
whitelisted
google.com
  • 142.250.186.142
whitelisted
ecsr.io
  • 188.114.97.3
  • 188.114.96.3
unknown
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.138
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

PID
Process
Class
Message
6696
ll.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
616
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ll.exe