URL:

https://sourceforge.net/projects/roblox-shaders/files/

Full analysis: https://app.any.run/tasks/2239c34c-fcf6-485d-a743-587238133987
Verdict: Malicious activity
Threats:

MicroStealer is a rapidly emerging infostealer first prominently observed in late 2025. It specializes in stealing browser credentials, active session data, screenshots, cryptocurrency wallets, and system information. It spreads quickly with low detection rates thanks to a sophisticated multi-stage delivery chain and exfiltrates data via Discord webhooks and attacker-controlled servers.

Malware Trends Tracker     >>>
Analysis date: April 29, 2026, 17:35:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
stealer
microstealer
Indicators:
MD5:

7E2102BD7140581F024A1C0C8B4EA9A9

SHA1:

0A1A77F117BC7DF924C3694696C95EF2874C050B

SHA256:

A2C9F91A2477D7128FE655A0B5A152D9EA17C456853D2CD310CEC8354B821EAF

SSDEEP:

3:N8HCGSuLAuUtyJG7XWY9Nn:2iGnCtaGTWYz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Attempting to use instant messaging service

      • micro.exe (PID: 8508)

    • MICROSTEALER has been detected (SURICATA)

      • micro.exe (PID: 8508)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 3152)

    • Actions looks like stealing of personal data

      • micro.exe (PID: 8508)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • robloxshaders.exe (PID: 2092)

    • Executable content was dropped or overwritten

      • robloxshaders.exe (PID: 2092)
      • Loader.exe (PID: 9452)
      • micro.exe (PID: 8508)

    • The process creates files with name similar to system file names

      • robloxshaders.exe (PID: 2092)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 4368)
      • cmd.exe (PID: 8604)

    • Get information on the list of running processes

      • robloxshaders.exe (PID: 2092)
      • cmd.exe (PID: 4368)
      • micro.exe (PID: 8508)

    • Drops 7-zip archiver for unpacking

      • robloxshaders.exe (PID: 2092)

    • Uses WMIC.EXE to obtain Windows Installer data

      • micro.exe (PID: 8508)

    • The process drops C-runtime libraries

      • Loader.exe (PID: 9452)

    • Uses WMIC.EXE to obtain a list of video controllers

      • micro.exe (PID: 8508)

    • Uses WMIC.EXE

      • micro.exe (PID: 8508)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 8604)

    • Uses TASKKILL.EXE to kill process

      • micro.exe (PID: 8508)

    • Uses TASKKILL.EXE to kill Browsers

      • micro.exe (PID: 8508)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 5420)
      • chrome.exe (PID: 7312)

    • Checks supported languages

      • identity_helper.exe (PID: 5412)
      • robloxshaders.exe (PID: 2092)
      • Loader.exe (PID: 9452)
      • micro.exe (PID: 8508)

    • Manual execution by a user

      • chrome.exe (PID: 7312)
      • WinRAR.exe (PID: 7648)
      • robloxshaders.exe (PID: 2092)
      • Loader.exe (PID: 1656)
      • Loader.exe (PID: 9452)

    • Reads the computer name

      • identity_helper.exe (PID: 5412)
      • robloxshaders.exe (PID: 2092)
      • micro.exe (PID: 8508)

    • Reads Environment values

      • identity_helper.exe (PID: 5412)
      • Loader.exe (PID: 9452)

    • Create files in a temporary directory

      • robloxshaders.exe (PID: 2092)
      • micro.exe (PID: 8508)

    • The sample compiled with english language support

      • robloxshaders.exe (PID: 2092)
      • Loader.exe (PID: 9452)

    • Reads security settings of Internet Explorer

      • robloxshaders.exe (PID: 2092)
      • WMIC.exe (PID: 9176)
      • WMIC.exe (PID: 3324)
      • WMIC.exe (PID: 7764)
      • WMIC.exe (PID: 9056)
      • WMIC.exe (PID: 880)
      • WMIC.exe (PID: 9492)
      • WMIC.exe (PID: 5300)
      • WMIC.exe (PID: 9484)
      • WMIC.exe (PID: 7984)
      • WMIC.exe (PID: 9248)
      • WMIC.exe (PID: 10068)
      • WMIC.exe (PID: 9696)
      • WMIC.exe (PID: 7960)
      • WMIC.exe (PID: 9076)

    • Creates files or folders in the user directory

      • robloxshaders.exe (PID: 2092)
      • Loader.exe (PID: 9452)
      • micro.exe (PID: 8508)

    • Creates a software uninstall entry

      • robloxshaders.exe (PID: 2092)

    • There is functionality for taking screenshot (YARA)

      • robloxshaders.exe (PID: 2092)

    • Reads product name

      • Loader.exe (PID: 9452)

    • Process checks computer location settings

      • Loader.exe (PID: 9452)

    • Reads the machine GUID from the registry

      • micro.exe (PID: 8508)

    • Attempting to use instant messaging service

      • micro.exe (PID: 8508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
371
Monitored processes
223
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs chrome.exe no specs msedge.exe no specs robloxshaders.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs loader.exe no specs loader.exe #MICROSTEALER micro.exe wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs systeminfo.exe no specs findstr.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs tiworker.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs msedge.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wmic.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\robloxshaders.rar"C:\Program Files\WinRAR\WinRAR.exe—msedge.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6376,i,8103742250755908768,11521106603883165524,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
800\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
880WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:ListC:\Windows\System32\wbem\WMIC.exe—micro.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1108FINDSTR /B /C:"OS Name:"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1284tasklist.exeC:\Windows\System32\tasklist.exe—micro.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1412"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\robloxshaders.rar"C:\Program Files\WinRAR\WinRAR.exe—msedge.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1652\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1656"C:\Users\admin\AppData\Local\Programs\Aleykum\Loader.exe" C:\Users\admin\AppData\Local\Programs\Aleykum\Loader.exe—explorer.exe
User:
admin
Company:
Loader
Integrity Level:
MEDIUM
Description:
Loader
Exit code:
3221226540
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\programs\aleykum\loader.exe
c:\windows\system32\ntdll.dll
1656taskkill /F /IM kometa.exeC:\Windows\System32\taskkill.exe—micro.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
16 594
Read events
16 521
Write events
60
Delete events
13

Modification events

(PID) Process:(1412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(1412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\robloxshaders.rar
(PID) Process:(1412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\robloxshaders.rar
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\robloxshaders.rar
(PID) Process:(496) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
Executable files
149
Suspicious files
480
Text files
439
Unknown types
4

Dropped files

PID
Process
Filename
Type
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RFdfb39.TMP —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFdfb48.TMP —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFdfb48.TMP —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFdfb58.TMP —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFdfb87.TMP —
MD5:—
SHA256:—
5420msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
649
TCP/UDP connections
278
DNS requests
317
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7176
msedge.exe
GET
200
104.18.23.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
text
25 b
whitelisted
7176
msedge.exe
GET
200
104.18.12.149:443
https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=9f40107b7a5d592b
US
text
189 Kb
unknown
7176
msedge.exe
GET
403
104.18.12.149:443
https://sourceforge.net/projects/roblox-shaders/files/
US
html
6.05 Kb
unknown
7176
msedge.exe
GET
200
52.123.243.71:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=67&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
US
text
3.65 Kb
whitelisted
7176
msedge.exe
GET
200
150.171.109.193:443
https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US
US
binary
82 b
whitelisted
7176
msedge.exe
GET
200
104.18.12.149:443
https://sourceforge.net/favicon.ico
US
image
1.48 Kb
unknown
7176
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:iZqGybDzKvCV12GekTWeFQC6InapTHiRH1XtwQttNjU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
97 b
whitelisted
7176
msedge.exe
GET
304
150.171.28.11:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
US
—
—
whitelisted
7176
msedge.exe
GET
403
104.18.12.149:443
https://sourceforge.net/projects/roblox-shaders/files/
US
html
5.85 Kb
unknown
7176
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
text
132 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8000
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7176
msedge.exe
52.123.243.71:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7176
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7176
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7176
msedge.exe
150.171.109.193:443
api.edgeoffer.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7176
msedge.exe
104.18.12.149:443
sourceforge.net
CLOUDFLARENET
US
whitelisted
7176
msedge.exe
104.18.23.222:443
copilot.microsoft.com
CLOUDFLARENET
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.127.113
  • 142.251.127.100
  • 142.251.127.138
  • 142.251.127.139
  • 142.251.127.102
  • 142.251.127.101
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 52.123.243.71
  • 52.123.243.74
  • 52.123.243.195
  • 52.123.243.95
  • 52.123.243.196
  • 52.123.243.82
  • 52.123.243.88
  • 52.123.243.198
whitelisted
sourceforge.net
  • 104.18.12.149
  • 104.18.13.149
whitelisted
api.edgeoffer.microsoft.com
  • 150.171.109.193
whitelisted
copilot.microsoft.com
  • 104.18.23.222
  • 104.18.22.222
whitelisted
www.bing.com
  • 184.86.251.5
  • 184.86.251.4
  • 184.86.251.29
  • 184.86.251.13
  • 184.86.251.10
  • 184.86.251.28
  • 184.86.251.15
  • 184.86.251.27
  • 184.86.251.18
  • 184.86.251.25
whitelisted
challenges.cloudflare.com
  • 104.18.95.41
  • 104.18.94.41
whitelisted
update.googleapis.com
  • 142.251.20.101
  • 142.251.20.102
  • 142.251.20.100
  • 142.251.20.138
  • 142.251.20.113
  • 142.251.20.139
whitelisted

Threats

PID
Process
Class
Message
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7176
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sourceforge.net/projects/roblox-shaders/files/